MCPDebugger

Fatmike's MCP Debugger Server Introduction This project is a self-made, lightweight MCP Debugger Server developed for learning and experimentation. The MCP Debugger Server exposes debugger functionality as MCP tools, enabling external MCP clients to control execution, inspect memory, and analyze...

PSI_BOF

ProcessInspect BOF Un BOF de CS que se puede usar para inspeccionar la memoria de procesos, direcciones y símbolos! Resumen de comandos Comando| Descripción ---|--- lm| lista todos los módulos cargados junto con dirección base, punto de entrada, y más addr| Imprime los bytes en una dirección de...

heapinfo

HeapInfo pwn을 즐기는 사람으로서 CTF에서 힙 익스플로잇을 할 때, 우리는 항상 메모리 레이아웃 추적을 위해 디버거예: gdb가 필요합니다. 하지만 힙 레이아웃이 우리의 상상과 같은지 확인하고 싶다면 gdb가 실제로 필요하지 않습니다. 이 작은 도구가 우리가 더 쉽게 익스플로잇할 수 있도록 도와주길 바랍니다 ;. 왜? HeapInfo 는 바이너리에 ptrace되는 것과 같은 안티-디버거 제한이 있을 때 매우 유용합니다. HeapInfo 는 ptrace를 사용하지 않기 때문에 여전히 작동합니다. Ruby를 사랑하기 때...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

linux-explorer

Questo progetto non è più mantenuto! Linux Expl0rer Un toolbox di live forensics facile da usare per endpoint Linux scritto in Python & Flask. Funzionalità ps Visualizza l'elenco completo dei processi Ispeziona la mappa di memoria del processo e recupera facilmente le stringhe di memoria Scarica ...

Sojobo - A Binary Analysis Framework

Sojobo is an emulator for the B2R2 framework. It was created to easier the analysis of potentially malicious files. It is totally developed in .NET so you don't need to install or compile any other external libraries the project is self contained. With Sojobo you can: Emulate a 32 bit PE binary...

Authentication flaw

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

CVE-2019-1573

GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN...

Heap overflow

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6.1 in 4.1.x, contains an Improper Clearing of Heap Memory Before Release 'Heap Inspection' vulnerability. Decoded PKCS 12 data in heap memory is not zeroized by MES before releasing the memory internally and a...

Apple macOS Sierra 10.12.1 - 'physmem' Local Privilege Escalation

physmem physmem is a physical memory inspection tool and local privilege escalation targeting macOS up through 10.12.1. It exploits either CVE-2016-1825 or CVE-2016-7617 depending on the deployment target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the...

Mimikittenz - Post-Exploitation Powershell Tool for Extracting Juicy info from Memory

mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory in order to extract plain-text passwords from various target processes. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns including but no...

Modular visual interface for GDB: GDB dashboard

Modular visual interface for GDB in Python This comes as a standalone single-file .gdbinit which, among the other things, enables a configurable dashboard showing the most relevant information during the program execution. Its main goal is to reduce the number of GDB commands issued to inspect th...

Oracle TNS Listener DoS and/or remote memory inspection

NGSSoftware Insight Security Research Advisory Name: Oracle TNS Listener DoS and/or remote memory inspection Systems Affected: Oracle 8.1.7.4, 10g Release 2 and 1, Oracle 9 Severity: High Vendor URL: http://www.oracle.com/ Author: David Litchfield [email protected] Reported: 22nd June 2006...