massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

tldfinder

TLDFinder 功能 • 安装 • 使用方法 • 运行 tldfinder • 加入 Discord 一款用于安全研究发现私有 TLD 的精简工具。 功能 基于 TLD 的 DNS 查询（被动） 基于 TLD 的 DNS 查询（主动） STD 输入/输出 以及 TXT/JSON 输出 安装 tldfinder 需要 Go 1.21 才能成功安装。要安装，只需运行以下命令，或从发布页面下载预编译二进制文件。 root@kitploit: go install github.com/projectdiscovery/tldfinder/cmd/tldfinder@latest 使用方法...

Spoofy

Spoofy QUÉ Spoofy es un programa que comprueba si una lista de dominios puede ser suplantada en función de los registros SPF y DMARC. Quizás te estés preguntando: "¿Por qué necesitamos otra herramienta que pueda comprobar si un dominio puede ser suplantado?" Bueno, Spoofy es diferente y he aquí p...

riskootext4shell

riskootext4shell text4shell script for text coomons =1.10 CVE-2022-33980 Apache Commons Text 库是 Java JDK 原生功能的替代库。 Apache Commons 的版本低于 1.10.0 类似于 CVE-2022-33980 root@kitploit: python3 text4shell.py -u http://192.168.245.111:8080/search?query= -i 192.168.111.186 -p 22 缓解措施 主要解决方案是紧急升级 Apache...

instarecon

InstaRecon Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do: DNS lookups A, PTR, MX, NS DNS lookups recursively on all hosts discovered Whois on domain and IP lookups Google dorks looking for...

CVE-2021-44228

Log4j 漏洞 更新于 2021年12月19日：Log4j 中不断发现新的漏洞及利用方式。我们在 git 仓库中添加了三个流程图（思维导图），分别描述 Log4j 的易受攻击版本、如何检查是否易受攻击 以及 针对不同漏洞的缓解措施。 建议 Log4j v2.x： 识别使用 Log4j 2.x 版本的软件 缓解 Log4j 中的漏洞 将使用 Log4j 的软件更新到使用 Log4j 2.17.0 的版本 如果上述操作不可行 确保已实施针对 CVE-2021-44228 和 CVE-2021-45046 的 缓解措施，请注意此时系统仍易受 DoS 攻击 如果系统特别关键，建议检查 Log4...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

quick-lookup-ptrun

PowerToys Run 的快速查找插件 该插件适用于 PowerToys Run，可让您在一系列网络安全工具中快速搜索 IP 地址、域名、哈希值或任何其他数据点。它非常适合安全分析师、渗透测试人员或任何需要在调查工件或警报时快速查找信息的人员。 安装 注意：自 PowerToys Run v0.72.0 或 v0.73.0 起（由于发行说明未提及，无法 100% 确定），PowerToys Run 插件的目录已更改！ 如果您已安装本插件或其他插件，并且最近停止工作，这可能是原因。您需要将插件从旧目录移动到新目录。 旧插件目录为： PowerToys 计算机范围安装： C:\Progr...

peer-tweet

PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...

dnssearch

dnssearch このソフトウェアはサブドメイン列挙ツールです。 目的 dnssearch は入力ドメイン -domain パラメータ とワードリスト -wordlist パラメータ を受け取り、ワードリストの各行をサブドメインとして使用して同時 DNS リクエストを実行し、最終的にトップレベルドメインで利用可能なすべてのサブドメインをブルートフォースします。 カスタムファイル拡張子 -ext、デフォルトは php やその他のオプション引数をサポートしています: root@kitploit: Usage of ./dnssearch: -consumers int Number of...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: jboss-logging (UTSA-2026-031579)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031579 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: metrics (UTSA-2026-093185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093185 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: Route lookups now perform under a RCU read-side lock. Our current route lookups mctproutelookup and mctproutelookupnull traverse the network’s route list without holding the RCU read lock. This means that the route lookups...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not prevent uncontrolled recursion from self-referential lookups. This allowed an attacker with control over the Thread Context Map data to cause a denial of service when a crafted string was interpreted. This issue w...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: Fixed NULL dereference in clkcoreget. It is possible for clkcoreget to dereference a NULL value in the following sequence: c clkcoreget ofclkgethwfromclkspec ofclkgethwfromprovider clkgethw clkgethw may return NULL, which wi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipc: fixed to protect IPCS lookups using RCU. syzbot reported that it discovered a use-after-free vulnerability. 0 0: https://lore.kernel.org/all/[email protected]/ idrforeach is protected by rwsem, but...