lisa.py

LLDB MCP 集成 本项目为 LLDB 提供了模型-上下文协议 MCP 集成，允许 AI 助手（如 Claude）通过标准化接口与您的调试会话进行交互。 概述 集成包含两个主要组件： 1. server.py — 一个与 Claude（或其他 MCP 客户端）通信的 MCP 服务器 2. lldbplugin.py — 一个在 LLDB 内部运行并通过 JSON-RPC 暴露调试器功能的插件 该架构使 Claude 能够通过自然语言直接与 LLDB 交互，帮助您调试代码。MCP 服务器充当桥梁，将 Claude 的请求转换为 LLDB 命令，并以结构化格式返回结果。 安装 前置条件...

http-mcp-bridge

HTTP MCP Bridge 该项目实现了一个HTTP服务器，充当HTTP/1.1请求与远程MCP服务器之间的桥接，使用mcp Python库（GitHub）。 此项目的主要目的是能够使用HTTP安全工具，通过远程传输机制（HTTP+SSE或Streamable HTTP）测试远程MCP服务器。 重要提示！ 据观察，在使用并发线程发送具有相同id的JSON-RPC-V2消息时，响应可能会被合并。在评估中使用此工具时请牢记这一点。在我们修复此问题期间，请确保使用单线程进行测试。 安装 首先克隆仓库并安装所需依赖： root@kitploit: git clone cd...

web3-decoder

Web3 Decoder Web3 Decoder 是一个 Burp Suite 扩展，可帮助分析涉及 web3 智能合约的操作具体发生了什么。这主要是对以太坊节点以及其他兼容网络（如 Polygon、Arbitrum、BSC…）节点的 JSON-RPC 调用。 下载与安装 下载最新的扩展 JAR — 此链接始终提供最新版本： ⬇ web3-decoder.jar（最新版本） 旧版本可在发布页面获取。 然后在 Burp Suite 中加载： 1. 转到 扩展 → 已安装 → 添加 。 2. 将 扩展类型 设置为 Java ，然后选择下载的 web3-decoder.jar。 3. 单击...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

mcpsnoop

面向 MCP 的 Wireshark。 一个透明代理，可在终端中实时显示你的 AI 客户端与 MCP 服务器之间的每一次真实工具调用。 问题所在 官方 MCP Inspector 以自身客户端身份连接，因此它永远看不到 你的 客户端（Cursor、Claude Code、Codex）实际发送给服务器的内容。而且，任何等待请求到达的工具都无法显示模型从未发起过的调用，或使用了错误参数的调用。当工具被静默跳过、能力不匹配，或调用只是挂起时，你只能翻查日志并不断猜测。 mcpsnoop 取而代之，置身于真实数据路径之中。 用它包装你的服务器命令，即可在真实客户端与服务器通信时，实时观察每一个...

CVE-2024-49369

CVE-2024-49369 概述 该漏洞利用 Icinga JSON-RPC 协议，针对运行 Icinga agent 的被监控节点进行利用。通过伪装成 Master/Satellite 实例，攻击者有可能接管 agent、执行任意命令或获取敏感信息。 如何使用 扫描 要扫描子网中易受攻击的 agent，请运行以下命令： root@kitploit: python3 main.py scan --subnet 192.168.0.0/24 --vuln --batch 25 该工具将以每批 25 个 IP 的方式扫描指定子网。它通过 JSON-RPC 协议发送 Icinga::HELL...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

CVE-2026-94050

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94050

An information disclosure vulnerability affects the ubus JSON-RPC interface of the D-Link DIR-X1860Z wireless router (firmware up to 1.0.2.220120.165402). The vulnerable functions are routerd.wificfg_get and routerd.get_rand_key , where manipulation allows an attacker on the local network to retr...

EUVD-2026-83787

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

web3-decoder

Web3 Decoder Web3 Decoder 是一款 Burp Suite 扩展，用于分析区块链操作和智能合约交互。它处理针对以太坊及兼容网络（包括 Polygon、Arbitrum、BSC 等）的 JSON-RPC 调用。 区块浏览器 API 密钥 大多数受支持的区块浏览器（如 etherscan.io）都要求提供 API 密钥，以允许每 5 秒超过 1 次请求。 要添加您的 API 密钥，您有 2 种选择： 您可以通过修改 .apikeys.json 文件来添加 API 密钥 您可以添加与 APIKEYS.json 文件中同名的环境变量 例如：export...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 (open source monitoring system) is vulnerable to improper access control in its JSON-RPC certificate update message handling (affected: 2.8 through 2.14.9, 2.15.4, and 2.16.2 ). The handler does not validate that the sender is a trusted endpoint, allowing an unauthenticated attacker with...

CVE-2026-63128

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

EUVD-2026-76937

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...

PT-2026-90782

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...