CVE-2025-60503

...

CVE-2022-22965

CVE-2022-22965 2022.04.02 16:44 Optimized POC, no longer a one-time validation Warning: This program will destroy log information integrity, please back up server data! Use only if you have server penetration test authorization! pocsuite -r CVE-2022-22965POCEXP.py -u url As shown below, the progr...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. 📥 Requirements root@kitploit: pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd...

AI-driven-MITRE-Attack

POC : AI-driven MITRE Attack Detection and Alert Enrichment This repository demonstrates a machine learning pipeline for detecting MITRE ATT&CK techniques from logs and enriching the output using a local LLM. Overview The project is divided into two main components : 1. Machine Learning Model ML ...

CVE-2026-88009

A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnerability allows a remote attacker to bypass security controls by sending a specially crafted HTTP/1 request. The request target is incorrectly processed, leading to cross-vhost routing bypass, path-scoped...

CVE-2021-44228

Log4j Vulnerability - CVE-2021-44228 📗 Introduction This vulnerability was discovered on December 9, 2021, identified with CVE-2021-44228 , this flaw affects the java log package, generating a Severity Score CVSS of 10 points , providing execution of remote access to the host. This vulnerability...

loglizer

loglizer Loglizer 是一个基于机器学习的日志分析工具包，用于自动化异常检测。 Loglizer是一款基于AI的日志大数据分析工具, 能用于自动异常检测、智能故障诊断等场景 日志在众多软件系统的开发和维护过程中至关重要。它们记录了系统运行期间的详细运行时信息，使开发人员和运维工程师能够监控其系统并跟踪异常行为和错误。Loglizer 提供了一套工具包，实现了多种基于机器学习的日志分析技术，用于自动化异常检测。 🔭 如果您在研究中使用了 Loglizer，并希望发表论文，请引用以下论文。 Shilin He, Jieming Zhu, Pinjia He, Michael R...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” A critical remote code execution vulnerability in Apache Log4j 2 , widely known as Log4Shell. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Exploitation & Impact Real-World Impact Detection Mitigation & Fixes Summary 🔎 Overview...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...

CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

winevt_logs_analysis

Winevt 日志分析（远程连接） 一个简单的脚本，用于查找对 Windows 机器的远程连接以及可能的公有 IP 地址。它会检查与远程登录和会话相关的一些事件 ID（EventID）。 你应该执行 pip install -r requirements.txt ，以便脚本能够运行并解析 winevt 文件夹中的一些 .evtx 文件。 winevt/Logs 文件夹与脚本必须具有相同的文件路径。 执行示例 结果示例...

CVE-2025-27591

Below - Local Privilege Escalation CVE-2025-27591 Below .log to any root-owned file like /etc/passwd. When below snapshot is executed with sudo, it forcibly sets mode 0666 on the log file and writes to it—even if it's a symlink. This allows injection of a root-privileged user without password,...

CVE-2019-17041

Rsyslog - what is it? Rsyslog is a r ocket-fast sys tem for log processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide...

latma

横向移动分析工具 横向移动分析工具（LATMA）从域环境和 Azure AD 环境中收集身份验证日志，并搜索潜在的横向移动攻击及可疑活动。横向移动可能发生在 AD 环境中，也可能发生在云与本地之间。该工具通过图表展示横向移动模式的可视化结果。此工具包含两个模块：一个用于收集日志，另一个用于分析日志。您可以分别执行每个模块。事件日志收集器应在运行 Python 3.8 或更高版本的 Windows 机器上执行，且该机器需处于 Active Directory 域环境中。分析器可在 Linux 机器和 Windows 机器上执行。 收集器 事件日志收集器具有两个功能：扫描域控制器以获取成功的...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

nginx_log_check

nginxlogcheck Nginx日志安全分析脚本 功能 统计Top 20 地址 SQL注入分析 扫描器告警分析 漏洞利用检测 敏感路径访问 文件包含攻击 Webshell 寻找响应长度的url Top 20 寻找罕见的脚本文件访问 寻找302跳转的脚本文件 Usage 设置报告保存地址 outfile 设置日志分析目录 accessdir 设置日志名称 accesslog ./nginxcheck.sh 参考 nmgxy klionsec...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

redact

redact 在字符串到达日志、遥测或任何第三方暴露面之前，剥离其中类似凭据的内容 属于phpboyscout Go 工具包的一部分 —— 从 go-tool-base 中提取的小型、无框架 Go 模块。文档：redact.go.phpboyscout.uk gitlab.com/phpboyscout/go/redact 在可信与不可信可观测性表面之间的边界上 ，从自由格式字符串中剥离类似凭据的内容 —— 遥测供应商、日志聚合器、指标存储。错误消息、命令行参数和 HTTP 头值经常无意中携带机密（包含内嵌用户信息的 URL、os.Args 中的 --api-key=sk-…...