uncle-spufus

█░░█ █▀▀▄ █▀▀ █░░ █▀▀ █▀▀ █▀▀█ █░░█ █▀▀ █░░█ █▀▀ v1.6" █░░█ █░░█ █░░ █░░ █▀▀ ▀▀█ █░░█ █░░█ █▀▀ █░░█ ▀▀█" ░▀▀▀ ▀░░▀ ▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀ █▀▀▀ ░▀▀▀ ▀░░ ░▀▀▀ ▀▀▀" Uncle Spufus v1.6 一个自动执行MAC地址和主机名欺骗的工具 什么是Uncle Spufus 我的长篇故事...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2022-23779

CVE-2022-23779: Vulnerabilidad de divulgación del nombre de host interno Información Descripción: Zoho ManageEngine Desktop Central anterior a 10.1.2137.8 expone el nombre del servidor instalado a cualquier persona. El nombre de host interno se puede descubrir leyendo las respuestas de redirecció...

HostHunter

HostHunter v2.0 一款高效发现和提取主机名的工具，可处理大量目标 IPv4 或 IPv6 地址。HostHunter 利用简单的 OSINT 和主动侦察技术，将 IP 目标与虚拟主机名进行映射。这对于发现组织真实的攻击面尤为有用。输出支持多种格式，包括 CSV、TXT 或 Nessus 文件格式。 演示 点击上方缩略图观看演示。 安装 已在 Python 3.10.8 上测试。 Linux / Mac OS 安装 Python 依赖。 root@kitploit: $ python3.10 -m pip install -r requirements.txt 简单使用示例...

CVE-2025-32462-Exploit

CVE-2025-32462-Exploit：Matrix-Sudo 逃脱 主机名欺骗权限提升 CVE-2025-32462 “你吃下蓝色药丸……故事结束。你吃下红色药丸……你将获得 root。” 描述 该漏洞利用程序演示了 sudo 中的一个权限提升漏洞 CVE-2025-32462，其中基于主机名的限制可以通过 -h 参数绕过。PoC 创建一个受限用户环境，然后通过欺骗白名单中的主机名来逃逸，从而获得 root 访问权限。 root@kitploit: user@matrix-node$ sudo -h zion-core bash 欺骗白名单主机名 root@matrix-node...

shodan

Shodan Dorks by twitter.com/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city. city:"Bangalore" country: Find devices in a particular country. country:"IN" geo: Find devices by giving geographical coordinates...

Cockpit Web Console < 360 - Remote Code Execution

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...

advisories

عني تويتر: @justinsteven المدونة: https://www.justinsteven.com/ النشرات الأمنية مُدرجة بترتيب زمني عكسي. انقر على أي عنوان لقراءة النشرة الأمنية الكاملة. ثغرة XSS في DOM عبر postMessage في أداة Gartner Peer Insights تاريخ الإفصاح: 2023-02-03 كانت أداة Gartner Peer Insights Widget تعاني من ثغرة XS...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts is a Bing.com web scraper to discover hostnames by IP address. Description Bing-ip2hosts is a Bing.com web scraper that discovers hostnames by IP address. Bing is the flagship Microsoft search engine formerly known as MSN Search and Live Search. It provides a feature...

shocker

Shocker A tool to find and exploit servers vulnerable to Shellshock Ref: https://en.wikipedia.org/wiki/Shellshocksoftwarebug Released as open source by NCC Group Plc - https://www.nccgroup.trust/ Developed By: Tom Watson, tom dot watson at nccgroup dot trust https://github.com/nccgroup/shocker...

EUVD-2026-64763

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding...

GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

poc-proxycommand-vulnerable

通过不安全的 /.ssh/config 实现RCE 在 ProxyCommand 中使用像 %h、%p 这样的令牌非常流行，用于通过SSH使用隧道和连接代理。 易受攻击的配置 root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 注意：在我最初的评估中，我以为使用 '%h'（单引号）可以避免这种情况，但看起来如果使用如下内容，仍然会存在漏洞： root@kitploit: url = ssh://'open...

EUVD-2026-69711

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...

CVE-2026-84642

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...

CVE-2026-84642

CVE-2026-84642 affects Mozilla Thunderbird , where the mail.allowed_attachment_hostnames advanced config setting values were inserted into a regular expression without escaping . For certain valid hostnames, this regex injection allowed unintended hostnames to match , enabling remote attachments ...

CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...