404 matches found
RITA-J
RITA Real Intelligence Threat Analytics in Jupyter Notebook RITA is an open source framework for network traffic analysis sponsored by Active Countermeasures RITA-J is the implementation of RITA features in Jupyter Notebook. The goal is to support all types of Firewall/Proxy/DNS logs that are in...
JndiLookup
JndiLookup Alguna herramienta para ayudar a analizar Apache Log4j 2 CVE-2021-44228 Esta herramienta utiliza la función "lookup" de log4j-2 para probar la vulnerabilidad JNDI. El objetivo es ejecutar fácilmente la función lookup para normalizar registros, por ejemplo, o para hacer una prueba real...
mig
MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...
DumpsterDiver
DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...
grapl
Grapl Grapl es una plataforma SIEM basada en grafos, construida por y para ingenieros de respuesta a incidentes. AVISO Grapl ha cesado operaciones como empresa. Por lo tanto, este código ya no se desarrolla activamente, pero permanecerá disponible en un estado archivado. Detalles Grapl aprovecha...
check-your-pulse
check-your-pulse Esta utilidad puede ayudar a determinar si existen indicadores de compromiso IOC en los archivos de registro de un Pulse Secure VPN Appliance para CVE-2019-11510. La Agencia de Seguridad de Infraestructura y Ciberseguridad CISA ha visto que muchas organizaciones han sido vulnerad...
ImpossibleTravelLogAnalysis
Análisis de Registros de Viaje Imposible por NCC Group Acerca de Herramienta básica de análisis de registros para detectar viajes imposibles mediante la información geográfica de las direcciones IP Formato de Datos Esperado Un archivo CSV con los siguientes encabezados root@kitploit:...
nginx-rift-detector
Detector de Rift NGINX para CVE-2026-42945 Verificador Bash de solo lectura para servidores NGINX comprometidos. Ayuda a un operador a responder dos preguntas tras la divulgación de CVE-2026-42945: ¿Este servidor sigue ejecutando una compilación NGINX expuesta o una configuración de reescritura...
apache-web-log-analysis-lab
Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...
CVE-2024-3400-Checker
Palo Vulnerability Check - CVE-2024-3400 Resumen Este script está diseñado para buscar signos de compromiso en sistemas Palo, específicamente para la vulnerabilidad identificada como CVE-2024-3400. Busca a través de archivos de paquete de soporte técnico gz o .tgz entradas de registro específicas...
wazuh v5.0.0-beta5
Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...
CVE-2026-72667
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...
CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...
UBUNTU-CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
CVE-2024-40683
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...
EUVD-2024-55704
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...
CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...
CVE-2024-40683
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...
CVE-2024-40683
CVE-2024-40683 affects IBM Operations Analytics – Log Analysis. The TOCTOU weakness in the built-in password management causes sessions not to be invalidated after a password change, potentially enabling an authenticated user to impersonate another user. Affected versions include 1.3.5.0–1.3.7.2 ...
PT-2026-66554
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...