massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

tldfinder

TLDFinder 功能 • 安装 • 使用方法 • 运行 tldfinder • 加入 Discord 一款用于安全研究发现私有 TLD 的精简工具。 功能 基于 TLD 的 DNS 查询（被动） 基于 TLD 的 DNS 查询（主动） STD 输入/输出 以及 TXT/JSON 输出 安装 tldfinder 需要 Go 1.21 才能成功安装。要安装，只需运行以下命令，或从发布页面下载预编译二进制文件。 root@kitploit: go install github.com/projectdiscovery/tldfinder/cmd/tldfinder@latest 使用方法...

Spoofy

Spoofy QUÉ Spoofy es un programa que comprueba si una lista de dominios puede ser suplantada en función de los registros SPF y DMARC. Quizás te estés preguntando: "¿Por qué necesitamos otra herramienta que pueda comprobar si un dominio puede ser suplantado?" Bueno, Spoofy es diferente y he aquí p...

riskootext4shell

riskootext4shell text4shell script for text coomons =1.10 CVE-2022-33980 Apache Commons Text 库是 Java JDK 原生功能的替代库。 Apache Commons 的版本低于 1.10.0 类似于 CVE-2022-33980 root@kitploit: python3 text4shell.py -u http://192.168.245.111:8080/search?query= -i 192.168.111.186 -p 22 缓解措施 主要解决方案是紧急升级 Apache...

instarecon

InstaRecon Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do: DNS lookups A, PTR, MX, NS DNS lookups recursively on all hosts discovered Whois on domain and IP lookups Google dorks looking for...

CVE-2021-44228

Log4jの脆弱性 2021年12月19日更新：Log4jにおける新たな脆弱性とそれらの悪用手法が次々と発見されています。リポジトリに3つのフローチャート（マインドマップ）を追加しました。それぞれ、脆弱なLog4jのバージョン、脆弱性の有無を確認する方法、および各脆弱性の軽減策について説明しています。 推奨事項 Log4j v2.x: Log4j バージョン 2.x を使用しているソフトウェアを特定する Log4j の脆弱性を軽減する Log4j 2.17.0 を使用しているバージョンにソフトウェアを更新する 上記が不可能な場合 CVE-2021-44228 および...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

quick-lookup-ptrun

PowerToys Run 用 Quick Lookup プラグイン この PowerToys Run 用プラグインを使用すると、IP アドレス、ドメイン名、ハッシュ、またはその他のデータポイントを、サイバーセキュリティツールのリストからすばやく検索できます。セキュリティアナリスト、ペネトレーションテスター、またはアーティファクトやアラートを調査する際に素早く情報を調べる必要があるすべての人に最適です。 インストール 注: Power Toys Run v0.72.0 または v0.73.0 以降 リリースノートには記載されていないため確実ではありません、Powertoys Run...

peer-tweet

PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...

dnssearch

dnssearch このソフトウェアはサブドメイン列挙ツールです。 目的 dnssearch は入力ドメイン -domain パラメータ とワードリスト -wordlist パラメータ を受け取り、ワードリストの各行をサブドメインとして使用して同時 DNS リクエストを実行し、最終的にトップレベルドメインで利用可能なすべてのサブドメインをブルートフォースします。 カスタムファイル拡張子 -ext、デフォルトは php やその他のオプション引数をサポートしています: root@kitploit: Usage of ./dnssearch: -consumers int Number of...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: jboss-logging (UTSA-2026-031579)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031579 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: metrics (UTSA-2026-093185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093185 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: Route lookups now perform under a RCU read-side lock. Our current route lookups mctproutelookup and mctproutelookupnull traverse the network’s route list without holding the RCU read lock. This means that the route lookups...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: Fixed NULL dereference in clkcoreget. It is possible for clkcoreget to dereference a NULL value in the following sequence: c clkcoreget ofclkgethwfromclkspec ofclkgethwfromprovider clkgethw clkgethw may return NULL, which wi...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not prevent uncontrolled recursion from self-referential lookups. This allowed an attacker with control over the Thread Context Map data to cause a denial of service when a crafted string was interpreted. This issue w...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipc: fixed to protect IPCS lookups using RCU. syzbot reported that it discovered a use-after-free vulnerability. 0 0: https://lore.kernel.org/all/[email protected]/ idrforeach is protected by rwsem, but...