RITA-J

RITA Real Intelligence Threat Analytics in Jupyter Notebook RITA is an open source framework for network traffic analysis sponsored by Active Countermeasures RITA-J is the implementation of RITA features in Jupyter Notebook. The goal is to support all types of Firewall/Proxy/DNS logs that are in...

JndiLookup

JndiLookup Alguna herramienta para ayudar a analizar Apache Log4j 2 CVE-2021-44228 Esta herramienta utiliza la función "lookup" de log4j-2 para probar la vulnerabilidad JNDI. El objetivo es ejecutar fácilmente la función lookup para normalizar registros, por ejemplo, o para hacer una prueba real...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

grapl

Grapl Grapl es una plataforma SIEM basada en grafos, construida por y para ingenieros de respuesta a incidentes. AVISO Grapl ha cesado operaciones como empresa. Por lo tanto, este código ya no se desarrolla activamente, pero permanecerá disponible en un estado archivado. Detalles Grapl aprovecha...

check-your-pulse

check-your-pulse Esta utilidad puede ayudar a determinar si existen indicadores de compromiso IOC en los archivos de registro de un Pulse Secure VPN Appliance para CVE-2019-11510. La Agencia de Seguridad de Infraestructura y Ciberseguridad CISA ha visto que muchas organizaciones han sido vulnerad...

ImpossibleTravelLogAnalysis

Análisis de Registros de Viaje Imposible por NCC Group Acerca de Herramienta básica de análisis de registros para detectar viajes imposibles mediante la información geográfica de las direcciones IP Formato de Datos Esperado Un archivo CSV con los siguientes encabezados root@kitploit:...

nginx-rift-detector

Detector de Rift NGINX para CVE-2026-42945 Verificador Bash de solo lectura para servidores NGINX comprometidos. Ayuda a un operador a responder dos preguntas tras la divulgación de CVE-2026-42945: ¿Este servidor sigue ejecutando una compilación NGINX expuesta o una configuración de reescritura...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

CVE-2024-3400-Checker

Palo Vulnerability Check - CVE-2024-3400 Resumen Este script está diseñado para buscar signos de compromiso en sistemas Palo, específicamente para la vulnerabilidad identificada como CVE-2024-3400. Busca a través de archivos de paquete de soporte técnico gz o .tgz entradas de registro específicas...

wazuh v5.0.0-beta5

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

CVE-2026-72667

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

UBUNTU-CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

EUVD-2024-55704

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

CVE-2024-40683 affects IBM Operations Analytics – Log Analysis. The TOCTOU weakness in the built-in password management causes sessions not to be invalidated after a password change, potentially enabling an authenticated user to impersonate another user. Affected versions include 1.3.5.0–1.3.7.2 ...

PT-2026-66554

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...