ProtOSINT

ProtOSINT ProtOSINT는 Proton 메일 계정을 조사하는 데 도움이 되는 Python 스크립트입니다. 버전 이것은 ProtOSINT v2 입니다. 첫 번째 버전은 몇 년 동안 있었지만, Proton의 API가 변경되고 기존 검사가 작동하지 않게 되어 재작성을 통해 도구를 다시 살렸습니다. 그동안 이런 종류의 연구를 계속해준 NeutrOSINT에게 큰 감사를 드립니다. 설명 이 도구는 Proton Mail에 대한 OSINT 작업교육 및 승인된 용도로만 사용을 위해 만들어졌습니다. 이메일 주소, 사용자 이름 또는...

talos

채팅 · 토론 · 뉴스레터 · 문서 · Ory Network 사용해보기 · 채용 Ory Talos는 저지연 검증, 수평적 확장, 예측 가능한 운영에 최적화된 확장 가능하고 안전한 API 키 서버입니다. 확립된 보안 모범 사례를 따라 고처리량 시스템을 위한 API 키를 발급, 검증, 폐기, 파생하며 단기 토큰도 관리합니다. Ory Talos란 무엇인가? 왜 Ory Talos인가 배포 옵션 Ory Network에서 Ory Talos 사용 Ory Talos 자체 호스팅 빠른 시작 Ory Talos를 사용하는 곳 생태계 Ory...

Arisu

Arisu — AI Key 自动化采矿系统 Arisu 是一款自动扫描公开代码仓库（GitHub、GitLab、Gitee、Docker Hub、PyPI、npm 等）和代码片段（Gist、Issues、CommonCrawl），提取 AI 服务 API 密钥（DeepSeek、OpenAI、Anthropic、Kimi 等）并验证其有效性及余额的工具。提供 TUI 仪表板和多种输出格式（JSON、CSV、Markdown）。 功能特性 🔍 多源扫描 ：GitHub 代码搜索、Sourcegraph、Gist、Issues、GitLab、Gitee、Docker...

CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM 사전 인증 SQL 인젝션 타이밍 PoC CVE-2026-42208에 대한 로컬 Docker 랩 및 최소 피해 PoC입니다. 이는 LiteLLM Proxy의 API 키 검증 경로에서 발생하는 사전 인증 SQL 인젝션 취약점입니다. 이 저장소는 타이밍 기반 PostgreSQL pgsleep 증명을 사용하여 취약한 LiteLLM 인스턴스와 패치된 LiteLLM 인스턴스 간의 차이를 보여줍니다. 범위: 로컬 랩 / 승인된 테스트 전용입니다. 기본 PoC는 데이터베이스 데이터를 덤프하거나...

CVE-2025-26465

CVE-2025-26465 OpenSSH 클라이언트는 6.8p1 9.9p1포함 버전 사이에 논리 오류가 있어, VerifyHostKeyDNS 옵션이 활성화된 경우 능동적 MitM 공격에 취약해집니다. 이로 인해 악의적인 침입자가 클라이언트가 연결을 시도할 때 합법적인 서버로 위장할 수 있습니다. 이 탐지 방법은 어떻게 작동하나요? 이 템플릿은 다음 취약한 버전을 매칭합니다: root@kitploit: - "SSH-2.0-OpenSSH6.8p1" - "SSH-2.0-OpenSSH6.9p1" -...

Astra Linux – Vulnerability in OpenSSH

A vulnerability was discovered in OpenSSH when the VerifyHostKeyDNS option is enabled. A man-in-the-middle attack can be carried out by a malicious machine pretending to be a legitimate server. This issue arises due to the way OpenSSH handles error codes under certain conditions during the...

qubes-secpack

Qubes セキュリティパック qubes-secpack Qubes セキュリティパック qubes-secpack は、Qubes OS プロジェクトに関するセキュリティ関連情報を含む git リポジトリです。以下が含まれます: Qubes PGP 鍵 keys/ Qubes セキュリティ速報 QSBs/ Qubes カナリア canaries/ Qubes 資金情報 fund/ Qubes ISO ダイジェスト digests/ このリポジトリに含まれるファイルは、認証を次の 2 つの方法で行うことができます: git コミットタグの検証 git tag -v...

CVE-2024-45337-POC

CVE-2024-45337-POC CVE-2024-45337 の概念実証 POC ビルド root@kitploit: go version go version go1.23.2 linux/amd64 go build 使用方法 root@kitploit: Usage of ./CVE-2024-45337-POC: -addr string Address of ssh server default "127.0.0.1:2222" -authorised-pubkey string The allowed pubkey that will pass verificatio...

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the knownhosts parser, where HostKey.name2type lacks OpenSSH certificate-type entries such as [email protected] in its static table, so a @revoked line authored with a...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

SummaryThe AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

GHSA-HQVF-45JJ-MCCQ AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to disabled SSH host key verification in the EMR SSH helper commands. An attacker can intercept SSH sessions and file transfers by performing a man-in-the-middle attack between the client a...

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in HSSPublicKeyParameters.getInstance and HSSSignature.getInstance, which read the HSS level count L from ...

CVE-2026-58060

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date through the public-key verification path in pkg/verify/signedentity.go. An attacker can get a bundle signed with expired long-lived key material accepted by supplying a signed bundle whose timestamp...

SUSE SLES12 Security Update : python-dulwich (SUSE-SU-2026:3408-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3408-1 advisory. This update for python-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key...