evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 Security research documenting an unauthenticated information disclosure and a cryptographic design flaw in IBERMATICA RPS 2019. The vulnerabilities can be chained to expose application logs containing authentication-related SQL queries and recov...

CVE-2026-67599_ClearOS_RCE

OS Command Injection in Log Viewer Filter Parameter Package: ClearFoundation Tested Versions: ClearOS 7.9.1.342252 Vulnerability Type: OS Command Injection CWE-78 Severity: High CVE : CVE-2026-67599 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Score: 7.2 Thank you to VulnCheck f...

watchTowr-vs-progress-moveit_CVE-2024-5806

CVE-2024-5806 Exploit for Progress MOVEit Transfer CVE-2024-5806. See our blog post at TBD. PoC in Action See --help for, well, help. A typical run should look like this: python CVE-2024-5806.py --target-ip 192.168.1.1 --target-user user2 --ppk id.ppk --pem id / | | |\ \ \ / / \ \ / | | | | / ...

CVE-2025-1974

🚨 Log Injection Test via Ingress-NGINX Admission Controller 🧠 Overview This script tests for annotation injection vulnerabilities in Kubernetes clusters using the NGINX Ingress Controller. It is meant for detection purposes only in relation to CVE-2025-1974, which allows malicious annotations to...

DEFCON-KQL-KUNG-FU-22

DEFCON-KQL-KUNG-FU-22 My DEFCON30 Cloud Village KQL Kung Fu Workshop slide deck lives here: DEFCON30-KQL-Kung-Fu.pdf If you'd like to practice your KQL skills, visit this Log Analytics Workspace that's maintained with tons of log data by Microsoft: aka.ms/lademo...

nginx-rift-detector

NGINX Rift Detector for CVE-2026-42945 Read-only Bash checker for owned NGINX servers. It helps an operator answer two questions after the CVE-2026-42945 disclosure: Is this server still running an exposed NGINX build or risky rewrite configuration? Do local logs show crash, long-URI, or encoding...

CVE-2024-43363

CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: Log Poisoning: An attacker injects PHP code into device names,...

CVE-2026-25548

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...

apache-web-log-analysis-lab

Apache Web Log Analysis Lab Blue Team lab focused on analyzing Apache HTTP server logs to detect web scanning activity, directory enumeration, and path traversal attempts. Objective Install and expose an Apache web server in an isolated lab environment, simulate automated web scanning using...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

CorelightForSecOps

Collect Corelight Sensor logs This document describes how you can collect Corelight Sensor logs by configuring the Corelight Sensor and a Chronicle forwarder. This document also lists the supported log types and supported Corelight versions. For more information, see Data ingestion to Chronicle...

key-transparency-auditor

key-transparency-auditor A reference implementation of a third-party auditor for Signal's key transparency service, based on the key transparency specification. Overview This service is written in Java using the Micronaut framework. To build and unit test, run ./mvnw clean test in the root...

airborn-IOS-CVE-2025-24252

iOS "Airborne" Vulnerabilities - Log Artifact Extractor This script is designed to help identify potential traces of the "Airborne" set of vulnerabilities primarily affecting Apple's AirPlay protocol by querying iOS system logs from a .logarchive bundle. It automates the execution of several log...

DumpsterDiver

DumpsterDiver by @Rzepsky DumpsterDiver is a tool, which can analyze big volumes of data in search of hardcoded secrets like keys e.g. AWS Access Key, Azure Share Key or SSH keys or passwords. Additionally, it allows creating a simple search rules with basic conditions e.g. report only csv files...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

KasperMeow

Kaspersky arkmon.sys KASLR Bypass via Kernel Debug Log Leak Kaspersky's anti-rootkit monitor driver arkmon.sys stores a kernel debug log containing raw kernel pointers. The log is "encrypted" with XOR 0xCC + ROT13 - trivially reversible. Any admin user can read and decrypt this log via IOCTL,...

deep-loglizer

Deep-loglizer Deep-loglizer is a deep learning-based log analysis toolkit for automated anomaly detection. If you use deep-loglizer in your research for publication, please kindly cite the following paper: Zhuangbin Chen, Jinyang Liu, Wenwei Gu, Yuxin Su, and Michael R. Lyu. Experience Report: De...

spring-boot-log4j-cve-2021-44228-docker-lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...

Ivanti-Connect-Secure-Logs-Parser

Ivanti Secure Connect Logs Parser This repository provides a Python script designed to convert Ivanti Secure Connect .vc0 log files into CSV format for digital forensics and incident response. In particular, the parser: Extracts timestamps from Ivanti log files notably from .vc0 files. Converts...