CVE-2019-17041

Rsyslog - what is it? Rsyslog is a r ocket-fast sys tem for log processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide...

latma

横向移动分析工具 横向移动分析工具（LATMA）从域环境和 Azure AD 环境中收集身份验证日志，并搜索潜在的横向移动攻击及可疑活动。横向移动可能发生在 AD 环境中，也可能发生在云与本地之间。该工具通过图表展示横向移动模式的可视化结果。此工具包含两个模块：一个用于收集日志，另一个用于分析日志。您可以分别执行每个模块。事件日志收集器应在运行 Python 3.8 或更高版本的 Windows 机器上执行，且该机器需处于 Active Directory 域环境中。分析器可在 Linux 机器和 Windows 机器上执行。 收集器 事件日志收集器具有两个功能：扫描域控制器以获取成功的...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

nginx_log_check

nginxlogcheck Nginx日志安全分析脚本 功能 统计Top 20 地址 SQL注入分析 扫描器告警分析 漏洞利用检测 敏感路径访问 文件包含攻击 Webshell 寻找响应长度的url Top 20 寻找罕见的脚本文件访问 寻找302跳转的脚本文件 Usage 设置报告保存地址 outfile 设置日志分析目录 accessdir 设置日志名称 accesslog ./nginxcheck.sh 参考 nmgxy klionsec...

below-log-race-poc

below-log-race-poc CVE-2025-27591 Exploit Below privilege escalation Description This repository contains a proof-of-concept exploit for CVE-2025-27591 , a privilege escalation vulnerability in the below utility. The issue arises because below mishandles log files under /var/log/below/, allowing...

redact

redact 在字符串到达日志、遥测或任何第三方暴露面之前，剥离其中类似凭据的内容 属于phpboyscout Go 工具包的一部分 —— 从 go-tool-base 中提取的小型、无框架 Go 模块。文档：redact.go.phpboyscout.uk gitlab.com/phpboyscout/go/redact 在可信与不可信可观测性表面之间的边界上 ，从自由格式字符串中剥离类似凭据的内容 —— 遥测供应商、日志聚合器、指标存储。错误消息、命令行参数和 HTTP 头值经常无意中携带机密（包含内嵌用户信息的 URL、os.Args 中的 --api-key=sk-…...

pwnspoof

pwnSpoof（来自 Punk Security）可针对常见 Web 服务器生成逼真的伪造日志文件，并支持可自定义的攻击场景。 每个日志包都是独一无二且完全可定制的，非常适合生成 CTF 场景以及培训系列。 您能否找到攻击者会话并构建事件全貌？ 目录 关于项目 入门指南 前提条件 安装 用法 选项 示例 查看演示 路线图 联系 关于项目 pwnSpoof 的诞生源于 Punk Security 为客户提供的威胁狩猎培训演练。该培训演练使用 Splunk（也可使用其他日志分析工具）和 IIS 日志来查找登录暴力破解攻击和命令注入。 pwnSpoof 应用的设计理念如下： 提供快速 CTF...

KasperMeow

Kaspersky arkmon.sys 通过内核调试日志泄露绕过 KASLR Kaspersky 的反 rootkit 监控驱动程序（arkmon.sys）存储了一份包含原始内核指针的内核调试日志。该日志使用 XOR 0xCC + ROT13 进行“加密”——可轻松逆向还原。任何管理员用户都可以通过 IOCTL 读取并解密此日志，从而完全绕过 KASLR。 在撰写本文时，该概念验证可在完全修补的 Windows 11 25H2 及 Kaspersky Standard: K4W-21-26（含最新数据库更新）上运行。...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition 远程代码执行 CVSS 9.8（严重） | 不安全的文件操作 → 日志投毒 → Phar 反序列化 → RCE 概述 Laravel Ignition -c "whoami" 参考 NVD — CVE-2021-3129 Ignition 补丁 2.5.2...

K000163364: Vim vulnerabilities CVE-2025-1215, CVE-2025-22134, CVE-2025-24014

Security Advisory Description CVE-2025-1215 A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the loca...

CVE-2025-27591

CVE-2025-27591 introduction below versions v0.9.0 are vulnerable to a local privilege escalation vulnerability duo to the fact that the program creates a world-writable log file, an a world writable log file instead, the attacker can replace the log file with a symblink to any system-critical fil...

CVE-2023-21839-metasploit-scanner

CVE-2023-21839-metasploit-scanner Usage git clone https://github.com/kurehalin/CVE-2023-21839-metasploit-scanner cd CVE-2023-21839-metasploit-scanner mkdir -p /.msf4/modules/auxiliary/scanner/http cp weblogiciioprce.py /.msf4/modules/auxiliary/scanner/http chmod +x...

CVE-2023-4281

CVE ID: CVE-2023-4281 Vulnerability Type: IP Address Spoofing Description: The Activity Log plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce:...

CVE-2025-27591-Below

CVE-2025-27591-Below 📌 Description This is a proof-of-concept PoC exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below system monitor tool. The issue arises from unsafe handling of log files /var/log/below/errorroot.log when executed with elevated privileges. By...

CVE-2019-19653

CVE-2019-19653 Chevereto information disclosure = 3.13.5 Core. Log files for the bulk importer are available for anyone to see and are easily enumerated root@kitploit: /app/importer/jobs/9/process.txt /app/importer/jobs/9/errors.txt...

CVE-2026-59310

CVE-2026-59310 More root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2026-49810

Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2024-1302---Badgermeter-moni-tool-Sensitive-information-exposure

CVE-2024-1302 --- Badgermeter moni tool - Sensitive information exposure https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1302: 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | CWE-200. Software link :...

CVE-2026-49810

Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-49810

Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low-privileged attacker with local access can exploit this to achieve Information Disclosure . The Dell security advisory (DSA-2026-379) describes the issu...