easyssh

EasySSH The SSH connection manager to make your life easier. Looking for maintainers! A complete, efficient and easy-to-use manager. Create and edit connections, groups, customize the terminal, with multiple instances of the same connection. Features Manage connections and groups Customize termin...

multitor

multitor 创建多个带负载均衡的TOR实例。 描述 • 简介 • 使用方法 • 参数 • 要求 • Docker • 其他 • 许可证 • Wiki 描述 它为客户端提供一个单一端点。支持 HAProxy 、socks 协议和 http-proxy 服务器：polipo 、privoxy 和 hpts 。 此外，你可以 查看 之前运行的 TOR 进程，并为全部或选定的进程创建 新身份 。 multitor 已基于以下项目完全重写： Jan Seidl 编写的 Multi-TOR 项目：Multi-TOR 原始来源（ Sebastian Wain 项目）：使用多个 TOR...

promptmap

O O o.-. Humans, Do Not Resist! |/ ,-'-. / /, / /|.-.| / --O-- .--""" /\ /\ | o.o / Utku Sen's /|\ -'--' / /| | - | / | | | \ /| | | ' \ '/ \ ' | ' \ | ' / | ' \ | / | | | ./| /||| ./|||,| .// / / |-----| || || || || promptmap2 is a an automated prompt injection scanner for custom LLM...

Log4j-CVE-2021-44228

Este escáner de Python detectará la vulnerabilidad log4j en instancias de Java y devolverá la respuesta...

melee

MELEE：用于检测 MySQL 实例中勒索软件感染的工具 攻击者正在滥用 MySQL 实例在互联网上实施恶意操作。网络犯罪分子瞄准暴露的 MySQL 实例，大规模触发感染以窃取数据、破坏数据并通过勒索索要钱财。例如，MySQL 部署面临的主要威胁之一是勒索软件。我们编写了一款名为 “MELEE” 的工具，用于检测 MySQL 实例中的潜在感染。该工具允许安全研究人员、渗透测试人员和威胁情报专家检测运行恶意代码的被攻陷和受感染的 MySQL 实例。该工具还使您能够针对以云数据库为目标的恶意软件进行高效研究。在此版本的工具中，支持以下模块： MySQL 实例信息收集与侦察 MySQL...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

poro

poro 描述 扫描 AWS 环境中公开可访问的资产 本工具覆盖的服务： AWS ELB API Gateway S3 存储桶 RDS 数据库 EC2 实例 Redshift 数据库 Poro 还会检查你指定的标签是否应用于已识别的公开资源，使用 --tag-key 和 --tag-value 参数。 先决条件 具有对上述服务只读权限的 AWS 账号 Python 3.X requests=2.22.0 boto3=1.20 botocore=1.20 enlighten=1 用法 克隆此仓库 使用有效凭证配置环境 - aws configure sso pip install -r...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

strafer

Strafer Elasticsearch 感染正呈指数级增长。攻击者利用开放和暴露的 Elasticsearch 接口在云和非云部署中触发感染。在此次演讲中，我们将发布一款名为 "STRAFER" 的工具，用于检测 Elasticsearch 实例中的潜在感染。该工具允许安全研究人员、渗透测试人员和威胁情报专家检测运行恶意代码的已受损和已感染 Elasticsearch 实例。该工具还使您能够针对以云数据库为目标的恶意软件进行高效研究。在此版本的工具中，支持以下模块： Elasticsearch 实例信息收集与侦察 Elasticsearch 实例在互联网上的暴露情况 检测...

CVE-2023-22515-POC

CVE-2023-22515 CVE-2023-22515, a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center, a Broken Access Control vulnerability. Attlassian has provided a CVSS base score of 10.0 Exploit Brief explanation: 1- Due to how Xwork interceptors parses...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

aws-suture

tl;dr $ git clone [email protected]:pblittle/suture.git $ cd suture $ bundle install $ bundle exec ./bin/suture --help $ bundle exec ./bin/suture check Suture Suture 是一个用于在您的 AWS EC2 实例上运行任意命令的工具。您可以针对单个实例或整个区域运行它。Suture 最初是为了确定我们正在运行的 EC2 实例中是否有任何实例使用了易受 Heartbleed 漏洞影响的 OpenSSL 版本而编写的。 一次...

CVE-2021-25790-Multiple-Stored-XSS

CVE-2021-25790-多个存储型XSS: 房屋租赁与房产列表系统V1.0中的多个存储型XSS漏洞 软件链接： https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code https://vulners.com/cve/CVE-2021-25790 https://nvd.nist.gov/vuln/detail/CVE-2021-25790 利用代码...

CVE-2025-14847

📝 MongoDB 扫描器 – 运行说明 脚本名称 mongoexposurescanner.py 1. 前提条件 Python 3.9+ 对目标主机的网络访问 已批准的扫描范围 验证 Python： python3 --version 2. 使用的文件 文件| 用途 ---|--- mongoscanner.py| 扫描器脚本 targets.txt| 目标主机和端口 mongoexposedtargets.txt| 扫描结果（自动创建） 3. 目标文件格式（targets.txt） 支持的格式： Host only default ports used 10.99.1.52...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...