lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | 使用法 ./lazyrecon.sh -d domain.com 特定のサブドメインを除外する場合: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com 概要 LazyRecon は Bash...

EntraFalcon

EntraFalcon EntraFalconは、ペンテスター、セキュリティアナリスト、システム管理者がMicrosoft Entra ID環境のセキュリティ態勢を評価するためのPowerShellベースの評価ツールです。 使いやすさを重視して設計されたEntraFalconは、PowerShell 5.1および7で動作し、WindowsとLinuxの両方をサポートしており、追加のPowerShellモジュール、追加インストール、Microsoft Graph APIの同意は不要です。...

DPAT

ドメインパスワード監査ツール DPAT DPATは、Active Directoryドメインコントローラーから抽出されたパスワードハッシュを分析するPythonベースのセキュリティツールです。NTDSダンプとパスワードクラッキング結果の両方から、パスワード使用統計、ポリシー違反、セキュリティインサイトを示す包括的なHTMLレポートを生成します。 サンプルレポート 機能 包括的なパスワード分析 : パスワードの長さ分布、再利用パターン、ポリシー違反を分析 インタラクティブなHTMLレポート : ドリルダウン機能を備えた詳細でクリック可能なHTMLレポートを生成 パスワード履歴サポート :...

otseca

Open source security auditing tool to search and dump system configuration. Introduction | Description | Requirements | Output | Parameters | Reports | How it works | Other Introduction The main goal The main assumption of creating this tool was easier and faster delivery of commands sets to be...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

custom-bytecode-analyzer

custom-bytecode-analyzer JSONルールでカスタマイズ可能なJavaバイトコードアナライザ。これはコマンドラインツールで、1つ以上のJarまたはWarファイルを含むパスを受け取り、提供されたルールを使用して解析し、結果のHTMLレポートを生成します。 使用方法 usage: java -jar cba-cli.jar OPTIONS -a DIRECTORYTOANALYZE -a,--analyze 解析を実行するディレクトリのパス。 -c,--checks 解析で実行されるカスタムチェックのスペース区切りリスト。 -f,--custom-file...

attackmapper

AttackMapper 攻撃パス可視化および脅威インテリジェンスプラットフォーム 機能 • インストール • 使用方法 • 脅威インテル • コントリビューション 概要 AttackMapper は、レッドチーム運用向けのCLIツールで、攻撃パスを生成し、テクニックをMITRE ATT&CKフレームワークにマッピングし、リアルタイムの脅威インテリジェンスと統合します。攻撃フローの可視化を備えたインタラクティブなHTMLレポートを生成します。 機能 機能| 説明 ---|--- 攻撃パスマッピング| 偵察からインパクトまでの完全なキルチェーンを可視化 MITRE ATT &CK統合|...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Bison vulnerability (USN-8777-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8777-1 advisory. It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker cou...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3907 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3908 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

vamp-forticheck

vamp-forticheck VampSecure Labs — Security Research Division Scanner di vulnerabilità critiche nei dispositivi FortiOS/FortiGate. Descrizione Strumento di audit di sicurezza per valutare l'esposizione dei dispositivi Fortinet rispetto a quattro vulnerabilità critiche pubblicamente documentate...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

OESA-2026-3307 bison security update

Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR GLR parser employing LALR1 parser tables. As an experimental feature, Bison can also generate IELR1 or canonical LR1 parser tables. Once you are proficient with...

OESA-2026-3306 bison security update

Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR GLR parser employing LALR1 parser tables. As an experimental feature, Bison can also generate IELR1 or canonical LR1 parser tables. Once you are proficient with...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...