JndiLookup

JndiLookup Alguna herramienta para ayudar a analizar Apache Log4j 2 CVE-2021-44228 Esta herramienta utiliza la función "lookup" de log4j-2 para probar la vulnerabilidad JNDI. El objetivo es ejecutar fácilmente la función lookup para normalizar registros, por ejemplo, o para hacer una prueba real...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

grapl

Grapl Grapl is a graph-based SIEM platform built by-and-for incident response engineers. NOTICE Grapl has ceased operations as a company. As such, this code is no longer being actively developed, but will remain available in an archived state. Details Grapl leverages graph data structures at its...

check-your-pulse

check-your-pulse This utility can help determine if indicators of compromise IOCs exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510. The Cybersecurity and Infrastructure Security Agency CISA has seen many organ izations breached despite patching their appliance because of...

ImpossibleTravelLogAnalysis

Impossible Travel Log Analysis by NCC Group About Basic log analysis tool to detect impossible travel via IP address geographic information Expected Data Format A CSV file with the following headers root@kitploit: When,User,Event,IP With the following format root@kitploit: 2019-04-09...

nginx-rift-detector

Detector de Rift NGINX para CVE-2026-42945 Verificador Bash de solo lectura para servidores NGINX comprometidos. Ayuda a un operador a responder dos preguntas tras la divulgación de CVE-2026-42945: ¿Este servidor sigue ejecutando una compilación NGINX expuesta o una configuración de reescritura...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

CVE-2024-3400-Checker

Palo Vulnerability Check - CVE-2024-3400 Overview This script is designed to check for signs of compromise in Palo systems, specifically for the vulnerability identified as CVE-2024-3400. It searches through tech support package gz or .tgz archive files for specific log entries that may indicate ...

deep-loglizer

Deep-loglizer Deep-loglizer is a deep learning-based log analysis toolkit for automated anomaly detection. If you use deep-loglizer in your research for publication, please kindly cite the following paper: Zhuangbin Chen, Jinyang Liu, Wenwei Gu, Yuxin Su, and Michael R. Lyu. Experience Report: De...

wazuh v5.0.0-beta5

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

CVE-2026-72667

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

UBUNTU-CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

EUVD-2024-55704

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

CVE-2024-40683 affects IBM Operations Analytics – Log Analysis. The TOCTOU weakness in the built-in password management causes sessions not to be invalidated after a password change, potentially enabling an authenticated user to impersonate another user. Affected versions include 1.3.5.0–1.3.7.2 ...

PT-2026-66554

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...