rip_raw

Rip Raw Rip Raw 是一个用于分析受感染 Linux 系统内存的小型工具。 其目的类似于 Bulk Extractor，但特别专注于从 Linux 系统的内存转储中提取系统日志。 这使您无需生成配置文件即可分析系统。 它不能替代 Rekall 和 Volatility 等使用配置文件进行更结构化内存分析的工具。 Rip Raw 通过获取原始二进制文件（如内存转储）并使用以下方式提取文件和日志： 文本/二进制边界 文件头部和文件幻数 日志条目 然后将其放入 zip 文件中，供其他工具（如 Cado Response 或 SIEM（如 Splunk））进行二次处理（示例如下）。 ...

RedEye

RedEye ：红队C2日志可视化 ⚠️ 此仓库当前处于维护模式 ⚠️ 本GitHub仓库不再积极开发。我们会审查社区的问题和拉取请求以便修复bug，但不会考虑任何新功能添加。 RedEye 是一个开源分析工具，由 CISA 和 DOE 的 太平洋西北国家实验室 开发，旨在帮助 红队 可视化和报告指挥与控制活动。该工具允许操作员评估和展示复杂数据，评估缓解策略，并针对红队评估做出有效决策。该工具解析日志（例如来自 Cobalt Strike 的日志），并以易于理解的格式呈现数据。用户随后可以标记工具内显示的活动并添加评论。操作员可以使用 RedEye...

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

grapl

Grapl Grapl 是一个基于图的 SIEM 平台，由事件响应工程师构建并为其服务。 注意 Grapl 已停止作为公司运营。因此，此代码不再积极开发，但将保持归档状态。 详细信息 Grapl 的核心利用图数据结构，确保您可以高效地查询和连接数据，为检测建模复杂的攻击者行为，并轻松深入可疑行为，以全面了解正在进行的入侵。 有关 Grapl 的更深入概述，请阅读此处。 本质上，Grapl 将获取原始日志，将其转换为图，并将这些图合并到主图中。然后，它将编排攻击签名的执行，并提供进行研究的工具。 您可以在 BSidesLV 或 BSides 旧金山 观看我们的一些演讲。 Grapl...

NVIDIA Virtual GPU Manager for Linux DoS (September 2026)

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled...

CVE-2026-95670: Improper Neutralization of Input During Web Page Generation

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-94593: Insertion of Sensitive Information into Log File

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available...

CVE-2026-47568

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of servic...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

PT-2026-104438

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description The backup and restore routine records the full database connection command in plain text within a log file on the host. This includes the superuser password, which can be used to gain...

PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

VulnCheck KEV: CVE-2026-56005

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1...

RabbitMQ 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Shovel Credential Disclosure via Crash Report

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.23, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by an information disclosure vulnerability: - The Shovel worker processes do not implement the formatstatus callbac...

CVE-2026-1661: Improper Neutralization of Input During Web Page Generation

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

check-your-pulse

check-your-pulse 此工具可帮助确定 Pulse Secure VPN 设备日志文件中是否存在针对 CVE-2019-11510 的入侵指标（IOC）。 美国网络安全和基础设施安全局（CISA）注意到，许多组织尽管已为其设备打补丁，但由于在打补丁之前被收集了 Active Directory 凭据（包括域管理员凭据），仍然遭到入侵。详情请参见 AA20-107A 警报。此工具可帮助组织在其日志中定位利用尝试，并根据结果评估风险。如果在打补丁日期之前发现了利用尝试，则可能需要密切关注未授权连接，并执行完整的域密码重置。 此工具中包含的 IOC 为...

CVE-2025-11177

在公开登录页面上使用基于时间的SQL注入负载触发SQL注入 curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

cve-2023-4966-iocs

扫描 CVE-2023-4966 的 IoCs 脚本: check-cve-2023-4966.py 该脚本搜索 Citrix NetScaler 日志，查找可能的 CVE-2023-4966 利用迹象。 用法 usage: check-cve-2023-4966.py -h --nologline logdirpath Python script to check CitrixNetScaler logs for possible CVE-2023-4966 exploitation positional arguments: logdirpath path to NetScaler...

burp-reflux

Analizador de registros reflux de Burp Proxy: conversor de registros de texto de Burp proxy a CSV y SQLLite Reflux para el análisis y conversión de registros de Burp Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Ollie Whitehouse, ollie punto whitehous...

ImpossibleTravelLogAnalysis

Análisis de Registros de Viaje Imposible por NCC Group Acerca de Herramienta básica de análisis de registros para detectar viajes imposibles mediante la información geográfica de las direcciones IP Formato de Datos Esperado Un archivo CSV con los siguientes encabezados When,User,Event,IP Con el...

GO-2026-6615 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log...