notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

PSRansom

PSRansom PSRansom 是一个具备C2服务器功能的PowerShell勒索软件模拟器。该工具可帮助您在安装了PowerShell的任何系统上模拟通用勒索软件的加密过程。借助集成的C2服务器，您可以通过HTTP外泄文件并接收客户端信息。 两个组件之间的所有通信均经过加密或编码，以避开流量检测机制，尽管始终未使用HTTPS。 需求 PowerShell 4.0 或更高版本 下载 建议克隆完整仓库或下载zip压缩包。 您可以通过运行以下命令来完成： root@kitploit: git clone https://github.com/JoelGMSec/PSRansom 使用方法...

grc2

nimc2 此软件尚处于非常早期的开发阶段，使用过程中可能会遇到许多问题 nimc2 是一款使用 nim 语言完全编写的非常轻量级的 C2。其用途范围涵盖用户支持到员工监控。 如果你想尝试一下，请查看 wiki 了解如何安装和使用 nimc2。它的特性包括： 生成 Windows 和 Linux 植入体 TCP 套接字和 HTTP 通信 能够创建任意数量的监听器 完善的任务系统 用于存储截图和下载文件的战利品系统 可自定义的模块，用于扩展植入体的自定义功能 易用的命令行界面 ……以及即将推出的更多功能 加入 discord 讨论此项目。 Wiki 快速上手 安装 Nimc2 快速入门...

ThunderShell

ThunderShell ThunderShell 是一个通过 HTTP 请求进行通信的 C RAT。所有网络流量都使用第二层 RC4 加密，以避免 SSL 拦截并绕过目标系统上的网络检测。RC4 是一种弱密码，用于帮助混淆流量。应使用 HTTPS 选项以提供完整性和强加密。 关于如何使用该工具及其支持功能的信息，请参阅 Wiki。 当前测试版 当前版本为 3.1.2 致谢 Mr.Un1k0d3r @MrUn1k0d3r Tazz0 @Tazz019 RingZer0 Team 2017...

CVE-2026-42033

A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HT...

EUVD-2004-2752

Malware in sbrugna...

EUVD-2022-43895

Malicious code in bioql PyPI...

CVE-2025-5087

CVE-2025-5087 affects Kaleris NAVIS N4 ULC (Ultra Light Client). The connected documents describe an unsafe Java deserialization vulnerability and insecure transmission of zlib-compressed data over HTTP, enabling an attacker who can observe traffic between Ultra Light Clients and N4 servers to ex...

CVE-2019-17393

The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP in cleartext that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and...

Multiple Threat Actors Deploying Open-Source Rafel RAT to Target Android Devices

Multiple threat actors, including cyber espionage groups, are employing an open-source Android remote administration tool called Rafel RAT to meet their operational objectives by masquerading it as Instagram, WhatsApp, and various e-commerce and antivirus apps. "It provides malicious actors with ...

How to disable StoreFront's http communication

How to disable StoreFront's http communication...

PT-2022-25422 · Wavlink · Wavlink Quantum D4G

Name of the Vulnerable Software and Affected Versions: WAVLINK Quantum D4G WN531G3 versions M31G3.V5030.200325 and earlier Description: The issue arises because the WAVLINK Quantum D4G WN531G3 communicates over HTTP instead of HTTPS, and its hashing mechanism does not rely on a server-supplied ke...

CVE-2021-20175

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface port 5000 is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be...

ScarCruft surveilling North Korean defectors and human rights activists

The ScarCruft group also known as APT37 or Temp.Reaper is a nation-state sponsored APT actor we first reported in 2016. ScarCruft is known to target North Korean defectors, journalists who cover North Korea-related news and government organizations related to the Korean Peninsula, between others...

CVE-2020-25493

Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic...

CVE-2020-25493

Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic...

Official Government COVID-19 Mobile Apps Hide a Raft of Threats

A rash of COVID-19 Android mobile apps have emerged that are aimed at helping citizens in Iran, Italy and Colombia track symptoms and virus infections. However, they’re also putting people’s privacy and the security of their data at risk, researchers have found. Security researchers at the ZeroFO...

AdvisorsBot Downloader Emerges in Raft of Malware Campaigns

A new downloader was disclosed today, sporting significant anti-analysis features and increasingly sophisticated distribution techniques. Researchers at Proofpoint have been tracking the downloader as a first-stage payload in campaigns since May 2018. Dubbed AdvisorsBot due to early...

Tunnel TCP connections over HTTP: Tunna

Tunnel TCP connections over HTTP Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. In a fully firewalled inbound and outbound connections restricted – except the webserver port. The...

Detect Shared Passwords: shard

A command line tool to detect shared passwords List available modules: $ java -jar shard-1.0.jar -l Available modules: Facebook LinkedIn Reddit Twitter Instagram Given a username and password shard will attempt to authenticate with multiple sites: $ java -jar shard-1.0.jar -u -p - Tried credentia...