seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

ogi-transforms

OGI トランスフォームレジストリ OGI（オープンソースのOSINTおよびリンク分析ツール）向けのコミュニティトランスフォームです。 仕組み transforms/以下の各ディレクトリは、個別にインストール可能なトランスフォームです。OGI CLIとTransform Hub UIはindex.json（マージごとに自動生成）を読み取り、利用可能なものを検出します。 トランスフォームのインストール OGIバックエンドプロジェクトからCLIを使用します： root@kitploit: cd backend uv sync uv run ogi transform search shoda...

ogi-transforms

OGI Transform Registry Community transforms for OGI, an open source OSINT and link analysis tool. How it works Each directory under transforms/ is an independently installable transform. The OGI CLI and Transform Hub UI read index.json auto-generated on each merge to discover what's available...

RpcInvestigator

RPC 조사기 저희의 블로그 포스트 공지사항을 읽어보세요. RPC 조사기RPCI는 .NET/C Windows Forms UI 애플리케이션으로, Windows RPC 엔드포인트에 대한 고급 검색 및 분석 인터페이스를 제공합니다. 이 도구는 NtApiDotNet 플랫폼의 기존 핵심 RPC 기능을 둘러싼 시각적 인터페이스를 제공하며, 다음을 포함합니다: 모든 활성 ALPC RPC 서버 열거 모든 PE 파일에서 RPC 서버 파싱 프로세스 및 해당 프로세스가 로드한 모듈서비스 포함에서 RPC 서버 파싱 심볼 서버에서 심볼 정보 가져오기...

mig

MIG: Mozilla InvestiGator MIG는 Mozilla의 원격 엔드포인트 조사 플랫폼입니다. ⚠️ 폐기 공지 ⚠️ Mozilla는 더 이상 Mozilla InvestiGator MIG 프로젝트를 유지보수하지 않습니다. Mozilla는 더 이상 이 코드를 내부적으로 사용하지 않습니다. 이 코드를 있는 그대로 사용할 수 있으며, 보증은 없습니다. 개발을 계속하려면 포크하십시오. Docker를 이용한 빠른 시작 Docker를 사용하여 로컬 전용 MIG 설정을 실행할 수 있습니다. 이 컨테이너는 프로덕션 용도에는 적합하지...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

EUVD-2026-85870

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072

The Velociraptor platform is vulnerable to a security bypass because it allows users to set the internal "compiled_collector_args" field via a user API call. This flaw allows a user with the minimal "investigator" role to inject compiled VQL statements for a hunt while bypassing standard ACL chec...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

PT-2026-71045

The hunt delete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT CLIENT usually assigned to the "investigator" role instead of the "DELETE RESULTS" permission usually only assigned to "administrators"...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

My Day Getting My Hands Dirty with an NDR System

My objective As someone relatively inexperienced with network threat hunting, I wanted to get some hands-on experience using a network detection and response NDR system. My goal was to understand how NDR is used in hunting and incident response, and how it fits into the daily workflow of a Securi...

VulnCheck KEV: CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

EUVD-2023-29974

Malicious code in bioql PyPI...

CVE-2025-6264

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...