410 matches found
lisa.py
LLDB MCP 集成 本项目为 LLDB 提供了模型-上下文协议 MCP 集成,允许 AI 助手(如 Claude)通过标准化接口与您的调试会话进行交互。 概述 集成包含两个主要组件: 1. server.py — 一个与 Claude(或其他 MCP 客户端)通信的 MCP 服务器 2. lldbplugin.py — 一个在 LLDB 内部运行并通过 JSON-RPC 暴露调试器功能的插件 该架构使 Claude 能够通过自然语言直接与 LLDB 交互,帮助您调试代码。MCP 服务器充当桥梁,将 Claude 的请求转换为 LLDB 命令,并以结构化格式返回结果。 安装 前置条件...
http-mcp-bridge
HTTP MCP Bridge 该项目实现了一个HTTP服务器,充当HTTP/1.1请求与远程MCP服务器之间的桥接,使用mcp Python库(GitHub)。 此项目的主要目的是能够使用HTTP安全工具,通过远程传输机制(HTTP+SSE或Streamable HTTP)测试远程MCP服务器。 重要提示! 据观察,在使用并发线程发送具有相同id的JSON-RPC-V2消息时,响应可能会被合并。在评估中使用此工具时请牢记这一点。在我们修复此问题期间,请确保使用单线程进行测试。 安装 首先克隆仓库并安装所需依赖: root@kitploit: git clone cd...
web3-decoder
Web3 Decoder Web3 Decoder 是一个 Burp Suite 扩展,可帮助分析涉及 web3 智能合约的操作具体发生了什么。这主要是对以太坊节点以及其他兼容网络(如 Polygon、Arbitrum、BSC…)节点的 JSON-RPC 调用。 下载与安装 下载最新的扩展 JAR — 此链接始终提供最新版本: ⬇ web3-decoder.jar(最新版本) 旧版本可在发布页面获取。 然后在 Burp Suite 中加载: 1. 转到 扩展 → 已安装 → 添加 。 2. 将 扩展类型 设置为 Java ,然后选择下载的 web3-decoder.jar。 3. 单击...
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...
mcpsnoop
面向 MCP 的 Wireshark。 一个透明代理,可在终端中实时显示你的 AI 客户端与 MCP 服务器之间的每一次真实工具调用。 问题所在 官方 MCP Inspector 以自身客户端身份连接,因此它永远看不到 你的 客户端(Cursor、Claude Code、Codex)实际发送给服务器的内容。而且,任何等待请求到达的工具都无法显示模型从未发起过的调用,或使用了错误参数的调用。当工具被静默跳过、能力不匹配,或调用只是挂起时,你只能翻查日志并不断猜测。 mcpsnoop 取而代之,置身于真实数据路径之中。 用它包装你的服务器命令,即可在真实客户端与服务器通信时,实时观察每一个...
CVE-2024-49369
CVE-2024-49369 概述 该漏洞利用 Icinga JSON-RPC 协议,针对运行 Icinga agent 的被监控节点进行利用。通过伪装成 Master/Satellite 实例,攻击者有可能接管 agent、执行任意命令或获取敏感信息。 如何使用 扫描 要扫描子网中易受攻击的 agent,请运行以下命令: root@kitploit: python3 main.py scan --subnet 192.168.0.0/24 --vuln --batch 25 该工具将以每批 25 个 IP 的方式扫描指定子网。它通过 JSON-RPC 协议发送 Icinga::HELL...
neto
Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...
CVE-2026-94050
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...
CVE-2026-94050
An information disclosure vulnerability affects the ubus JSON-RPC interface of the D-Link DIR-X1860Z wireless router (firmware up to 1.0.2.220120.165402). The vulnerable functions are routerd.wificfg_get and routerd.get_rand_key , where manipulation allows an attacker on the local network to retr...
EUVD-2026-83787
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...
web3-decoder
Web3 Decoder Web3 Decoder 是一款 Burp Suite 扩展,用于分析区块链操作和智能合约交互。它处理针对以太坊及兼容网络(包括 Polygon、Arbitrum、BSC 等)的 JSON-RPC 调用。 区块浏览器 API 密钥 大多数受支持的区块浏览器(如 etherscan.io)都要求提供 API 密钥,以允许每 5 秒超过 1 次请求。 要添加您的 API 密钥,您有 2 种选择: 您可以通过修改 .apikeys.json 文件来添加 API 密钥 您可以添加与 APIKEYS.json 文件中同名的环境变量 例如:export...
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
CVE-2026-61550
Icinga 2 (open source monitoring system) is vulnerable to improper access control in its JSON-RPC certificate update message handling (affected: 2.8 through 2.14.9, 2.15.4, and 2.16.2 ). The handler does not validate that the sender is a trusted endpoint, allowing an unauthenticated attacker with...
CVE-2026-63128
A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...
EUVD-2026-76937
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...
CVE-2026-90668
UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...
PT-2026-90782
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...