CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257은 Fortinet FortiWeb의 Fabric Connector 구성 요소에 영향을 미치는 치명적인 인증 전 SQL 인젝션 취약점입니다. 영향을 받는 FortiWeb 버전은 다음과 같습니다: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 기술 세부 사항 이 문제는 getfabricuserbytoken 함수에서 발생하며, 이 함수는 검증되지 않은 사용자 입력Authorization: Bearer HTTP 헤더을 사용하여 SQL 쿼리를...

IDAssistMCP

IDAssistMCP Standalone MCP Model Context Protocol server plugin for IDA Pro 9.x that exposes IDA's analysis capabilities to LLM clients like Claude Desktop. Features 41 MCP tools covering binary analysis, decompilation, cross-references, symbol management, type system, navigation, patching, expor...

IAGA-Sentinel

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Setup in one prompt · Quickstart...

XboxSeries

Xbox Series: Internal Architecture Research Field| Value ---|--- Date| March 9-12, 2026 + July 7-?, 2026 Hardware| Xbox Series S Codename: Lockhart OS Build| 26100.7010.amd64fre.xbflt2602ge.260212-1010 + 26100.8561.amd64fre.xbflt2606ge.260609-2200 Access Method| Dev Mode + SSH + REST API + NTFS...

t14m4t

t14m4t t14m4t is an automated brute-forcing attack tool, wrapper of THC-Hydra and Nmap Security Scanner. t14m4t is scanning an user defined target or a document containing targets for open ports of services supported by t14m4t , and then starting brute-forcing attack against the services running ...

AMDH

AMDH Android Mobile Device Hardening written with python3. Android version, PObY-A Privacy Owned by You - Android, with malware and settings scans is available on the Play Store and the source code can be found HERE Motivations AMDH was created to help automate scanning installed applications on...

OpenCRE

OpenCRE 前往 https://www.opencre.org 查看 OpenCRE 的实际运行效果和更多说明。 OpenCRE 全称是 Open Common Requirement enumeration（开放通用需求枚举）。它是一个交互式内容链接平台，用于整合安全标准与指南。在设计、开发、测试和采购安全软件时，它能够提供简便而可靠的相关信息访问途径。 OpenCRE 包含： 应用程序：一个用于访问数据的 Python Web 和 CLI 应用程序，公开运行于 opencre.org 目录数据：通用需求（CRE）目录 映射数据：从每个 CRE 到一系列标准中相关章节的链接...

zmap

ZMap: The Internet Scanner ZMap는 인터넷 전체 네트워크 조사를 위해 설계된 빠른 상태 비저장 단일 패킷 네트워크 스캐너입니다. 기가비트 이더넷 연결이 있는 일반 데스크톱 컴퓨터에서 ZMap는 단일 포트의 전체 공개 IPv4 주소 공간을 45분 이내에 스캔할 수 있습니다. 예를 들어, 잠재적인 SMTP 서버를 찾기 위해 포트 25의 모든 IPv4 주소에 TCP SYN 패킷을 전송합니다. 10gigE 연결과 netmap 또는 PFRING을 사용하면 ZMap는 5분 이내에 IPv4 주소 공간을 스캔할 수...

MITM6-Kerberos-CNAME-Abuse

Kerberos Authentication Relay - CNAME Abuse Technique PoC Background This tool is the proof-of-concept for Kerberos CNAME Abuse Relay technique, based on the MITM6 tool. The research uncovered a flaw in Windows Kerberos client behavior: when a DNS CNAME record is returned, the client follows the...

wordpot

Wordpot Wordpot은 WordPress 설치의 플러그인, 테마, timthumb 및 기타 일반적인 파일을 탐지하는 WordPress 허니팟입니다. root@kitploit: $ python wordpot.py --help Usage: wordpot.py options Options: -h, --help show this help message and exit --host=HOST Host address --port=PORT Port address --title=TITLE Blog Title --theme=THEME...

Android-PIN-Bruteforce

🔓📱 Android-PIN-Bruteforce Unlock an Android phone or device by bruteforcing the lockscreen PIN. Turn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! 📱 How it works It uses a USB OTG cable to connect the locked phone to the Nethunter device. It emulates a keyboard,...

CVE-2022-45988

CVE-2022-45988 StarSoftComm HP CooCare An elevation of privilege vulnerability exists I have contacted with hp-security-alert They have fixed this bug. About StarSoftComm CooCare HP-PSRT-IR 4106 The vendor responded with the following information: Follow these steps to update: 1. Launch eService ...

UPnPHostFileRead

Description Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of LOCAL SERVICE. Tested against Windows 11 Pro build 26200.8457. Reported to Microsoft. Assessed as "not a vulnerability". How to Build 1. Clone the repository. 2...

tengu

Tengu — Pentesting MCP Server "In Japanese mythology, the Tengu is a fierce mountain spirit — master strategist, warrior, and trainer of samurai. In cybersecurity, it guides you through every phase of the hunt." From recon to report — AI-assisted pentesting in one command. Tengu is an MCP server...

burpflow

BurpFlow BurpFlowは、HTTPリクエストをBurp Suiteプロキシ経由でルーティングする軽量なNode.js CLIツールです。セキュリティテスターは、reconで収集したURLをすばやくBurpに読み込んで分析できます。 🎯 BurpFlowとは？ BurpFlow は、ペネトレーションテスター 、バグバウンティハンター 、セキュリティ研究者 向けに設計された、高速・効率的・最小限のrecon自動化CLIツール です。 Burpプロキシを介してHTTPリクエストを送信するプロセスを簡素化し、次のことが可能になります: 大規模なURLリストをBurp...

pentest-ai

pentest-ai It doesn't flag. It proves. Website · Install · Why verification · Benchmarks · Limits · Discord ⚠️ Offensive tooling, authorized testing only. By installing you accept the AUP and Terms. See Responsible use ↓ Two minutes, no API key, no target of your own root@kitploit: pip install pta...

jumpserver

An open-source PAM platform Bastion Host English · 中文简体 · 中文繁體 · 日本語 · Português Brasil · Español · Русский · 한국어 What is JumpServer? JumpServer is an open-source Privileged Access Management PAM platform that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes,...

jumpserver

오픈 소스 PAM 플랫폼점프 서버 JumpServer란 무엇인가요? JumpServer는 DevOps 및 IT 팀에게 웹 브라우저를 통해 SSH, RDP, Kubernetes, 데이터베이스 및 원격 애플리케이션 엔드포인트에 대한 온디맨드 및 안전한 액세스를 제공하는 오픈 소스 권한 있는 액세스 관리PAM 플랫폼입니다. 빠른 시작 깨끗한 리눅스 서버를 준비하세요 64 비트, = 4c8g root@kitploit: curl -sSL...

CVE-2020-11881

CVE-2020-11881 MikroTik SMB Remote Denial of Service DoS This report describes CVE-2020-11881, an unauthenticated remote DoS for MikroTik's SMB service running on RouterOs. The vulnerability allows an attacker to crash the running SMB service and was responsible disclosed to securitymikrotik.com ...

GyoiThon

GyoiThon : 차세대 침투 테스트 도구 일본어 페이지는 여기에 있습니다. 발표 2018년 1월 25일: JANOG41 2018년 3월 23일: Black Hat ASIA 2018 Arsenal 2018년 8월 12일: DEFCON26 DemoLabs 2018년 10월 24일: OWS in CSS2018 2018년 11월 3일: AV TOKYO 2018 HIVE 2018년 12월 22-23일: SECCON YOROZU 2018 2019년 3월 28일: Black Hat ASIA 2019 Arsenal 문서 설치 사용법 팁 ...