Outpacket

📦 Outpacket 厌倦了 impacket？ 本速查表将常见 impacket 工作流映射到其现代替代方案 目录 身份验证快速参考 1. 远程执行 WMI 执行 · wmiexec.py DCOM 执行 · dcomexec.py 基于服务的执行 · smbexec.py · psexec.py 计划任务执行 · atexec.py 批量执行 · wmiexec.py · psexec.py 2. Kerberos 请求 TGT · getTGT.py 请求 TGS · getST.py S4U2self / S4U2proxy · getST.py -impersonate...

conjur

Conjur Maintainability Test Coverage Conjurは、現代のインフラストラクチャ向けにシークレット管理とアプリケーションIDを提供します。 マシン認証マークアップ言語（"MAML"） ：ロールベースのアクセスポリシー言語で、システムコンポーネントとそのロール、権限、メタデータを定義します。 REST Webサービス ： 人間とマシンのIDライフサイクルを管理 シークレットインフラ内のロールとデータを整理・検索 高度な権限モデルを使用してリソースへのアクセスを承認 シークレットを保存し、安全に利用可能にする クラウドツールチェーン全体の統合 ：...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC CVE-2025-54110 利用代码实现——Windows NtQueryDirectoryObject 系统调用中的内核级整数溢出漏洞。 CVE-2025-54110 - Windows 内核整数溢出分析 CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110 本仓库包含针对 CVE-2025-54110 内核权限提升漏洞的仅崩溃 PoC ，专为安全研究、逆向工程和利用开发研究 而开发。该代码旨在演示漏洞研究技术，包括： 使用...

CVE-2026-54452

safeurl (github.com/doyensec/safeurl), a Go SSRF protection library, has an incomplete IPv6 private network blocklist in ip.go prior to v0.2.4 . Four newly assigned CIDR ranges are omitted: 64:ff9b:1::/48 (NAT64, RFC 8215), 5f00::/16 (Segment Routing SIDs, RFC 9602), 3fff::/20 (documentation, RFC...

EUVD-2026-77630

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

DepFuzzer

DepFuzzer DepFuzzer 是一个用于发现依赖混淆（dependency confusion）或项目所有者邮箱可被接管问题的工具。 安装工具 /!\ 此工具要求 Python = 3.10 /!\ root@kitploit: $ python3 -m venv .venv $ source .venv/bin/activate $ pip3 install -r requirements.txt 或者你也可以使用 Docker 镜像： root@kitploit: $ docker build -t depfuzzer:latest . $ docker run --rm...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check

A flaw was found in golang.org/x/crypto/ssh. The Verify method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters

A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during...

golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey

A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496

ExifReader (npm package exifreader), a JavaScript Exif metadata parser, is vulnerable to denial of service via crafted HEIC/AVIF files in versions prior to 4.40.1 . The ISO-BMFF parser in src/image-header-iso-bmff.js accepts an 8-byte box header without verifying that required fields remain withi...

EUVD-2026-77628

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

Fault-Injection-Finder

故障注入查找器 root@kitploit: ▄▖ ▜ ▗ ▄▖ ▘ ▗ ▘ ▄▖▘ ▌ ▙▖▀▌▌▌▐ ▜▘ ▐ ▛▌ ▌█▌▛▘▜▘▌▛▌▛▌ ▙▖▌▛▌▛▌█▌▛▘ ▌ █▌▙▌▐▖▐▖ ▟▖▌▌ ▌▙▖▙▖▐▖▌▙▌▌▌ ▌ ▌▌▌▙▌▙▖▌ ▙▌ Geeoon Chung 和 Nate Snyder 本仓库是我们故障注入攻击项目的软件部分。硬件部分请查看此仓库。 项目总览 本项目旨在找出程序执行中被跳过/NOP 后会导致安全问题的指令。 1. 预处理 1. 加载二进制文件 2. 识别被 NOP 后更有可能导致安全问题的指令。 2. Unicorn 模拟 1. 运行程序，将第 n...

Threat-Hunting

Caza de Amenazas | Ingeniería de Detección Colección de consultas de caza de amenazas y detección para: CrowdStrike Falcon usando CQL – CrowdStrike Query Language Microsoft Defender XDR usando KQL – Kusto Query Language Diseñado para detectar procesos sospechosos, comportamientos de red anómalos,...