smbclient-ng

smbclient-ng，一种快速且用户友好的与 SMB 共享交互的方式。 !NOTE 查看用 Go 编写的新版 smbclient-ng，默认更快且跨平台！ https://github.com/TheManticoreProject/smbclient-ng 功能 acls：列出当前工作目录中文件和文件夹的 ACL。语法：acls bat：美观地打印文件内容。语法：bat bhead：美观地打印文件的前 n 行。语法：bhead btail：美观地打印文件的后 n 行。语法：btail cat：获取文件内容。语法：cat cd：更改当前工作目录。语法：cd close：关闭与远程机器...

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell 简介 我在 LetsDefend 实验室中研究了一个名为 ToolShell CVE-2025-53770 的 SharePoint 零日漏洞。我模拟了一场真实的零日攻击，其中恶意 POST 请求绕过身份验证，运行 PowerShell 窃取 MachineKeySection 密钥，编译 payload.exe，并植入了一个 Web 后门 spinstall0.aspx。我记录了所有操作，分析了行为，并隔离了主机。本 README...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.57 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

vigolium v0.4.4

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

OWASP-Open-Source-Intelligence-Standard

Open-source intelligence now informs decisions that affect liberty, safety, and national security. OOVS is an open standard that makes those decisions defensible. Every judgment traceable to its origin · every requirement testable against published criteria · AI output never mistaken for evidence...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

secure-by-default-rce-demo

Node.js RCE 缓解：DevOps 作为最后一道防线 本项目演示了 Next.js 应用程序（特别是通过服务器操作）中的一个严重远程代码执行 RCE 漏洞，以及基础设施加固 如何在代码漏洞仍然存在的情况下有效阻止攻击。 它对比了使用Distroless 镜像和只读文件系统 的标准“不安全”部署与强化后的“安全”部署。 🛡️ 概念：深度防御 软件漏洞不可避免。当代码失效时，你的基础设施必须阻止攻击者扩大立足点。 漏洞 Next.js 使用的 React 服务器组件 RSC 实现中存在一个严重 RCE 漏洞（CVE-2025-55182，又名 React2Shell） 。 CVSS...

CVE-2026-84830 OS command injection in privileged configuration handling

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges...

CVE-2026-84830

SEPPmail Secure Email Gateway versions before 15.0.7 are affected by an OS command injection vulnerability in privileged configuration handling. An authenticated administrator can exploit this flaw to execute commands with elevated privileges, resulting in high impact to confidentiality, integrit...

CVE-2026-84830 OS command injection in privileged configuration handling

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges...

EUVD-2026-70365

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges...

Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Xibo CMS Zip Slip RCE 漏洞利用工具 CVE-2023-33177 该漏洞利用工具演示了 Xibo CMS（CVE-2023-33177）中的路径遍历漏洞 ，该漏洞可通过恶意布局文件导入实现远程代码执行。 漏洞详情 CVE/公告： CVE-2023-33177 受影响版本： Xibo CMS 1.8.0 - 2.3.16 Xibo CMS 3.0.0 - 3.3.4 漏洞类型： 路径遍历（Zip Slip） 影响： 远程代码执行（RCE） 技术摘要 Xibo CMS 允许已认证用户通过 ZIP 压缩包导入布局文件。导入功能未能正确验证 mapping.json...

monitor v0.41.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

AzureHound v3.1.1-rc1

AzureHound The BloodHound data collector for Microsoft Azure Get AzureHound Release Binaries Download the appropriate binary for your platform from one of our Releases. Rolling Release The rolling release contains pre-built binaries that are automatically kept up-to-date with the main branch and...

BadUSB-Files-For-FlipperZero

Ducky-Script-For-FlipperZero 本仓库是一个脚本合集，这些脚本已专门针对 FlipperZero 上的 BadUSB/BadKB 功能进行了更新。 不过，它们在任何使用 Ducky Script 的设备上也应该可以正常工作。 这些脚本涵盖从无害的恶作剧到恶意的红队工具。 ⚠️ 法律与道德声明 本仓库仅用于教育、研究、实验室环境以及经授权的安全评估 。 此处展示的工具和技术仅可用于： 你自己的实验室或测试环境。 针对你拥有的系统。 针对你已获得所有者明确许可的系统。 未经授权将这些材料用于第三方系统是非法且不道德的。...

user-scanner v1.5.1

User Scanner A powerful 2-in-1 OSINT suite engineered for deep Email and Username Intelligence. With 465+ total scan vectors —including 175+ email-integrated sites and 290+ username platforms —you can map digital footprints, analyze target behavior, uncover interests, full metadata of usernames a...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

Security update for kubevirt, virt-pr-helper-container

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place...

Tenda-Router-VR-and-Exploit

Tenda-Router-VR-and-Exploit 这篇说明详细展示了我如何仿真AC15 V15.03.05.19固件的Web服务器，使用QEMU，使其可以从主机浏览器访问，并利用存在漏洞的/goform/setUsbUnload处理程序（CVE-2020-10987）在仿真的根文件系统中执行命令。 概述 从固件镜像中提取（在我们的案例中是获取）squashfs文件系统并开始逆向分析 构建一个在qemu-system-arm下运行的Debian armhf虚拟机 设置虚拟机的网络和端口转发路径到仿真的路由器 构建我们的启动脚本 攻击仿真的路由器 提取文件系统...

Security update for cosign

This update for cosign rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...