DockerSpy

DockerSpy DockerSpy recherche des images sur Docker Hub et extrait des informations sensibles telles que des secrets d'authentification, des clés privées, etc. Qu'est-ce que Docker ? Docker est une plateforme open-source qui automatise le déploiement, la mise à l'échelle et la gestion des...

quantum

Shor's Algorithm for ECDLP — Q-Day Prize Submission Quantum solver for the Elliptic Curve Discrete Logarithm Problem ECDLP, built for the Q-Day Prize Challenge by Project Eleven. The goal: recover ECC private keys on real quantum hardware using Shor's algorithm. Author : Giancarlo Lelli Contact :...

gpg_reaper

GPG Reaper TL;DR: Obtain/Steal/Restore GPG Private Keys from gpg-agent cache/memory This POC demonstrates method for obtaining GPG private keys from gpg-agent memory under Windows. Normally this should be possible only within 10 minutes time frame --default-cache-ttl value. Unfortunately...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

shhgit

🚨 shhgit больше не поддерживается. Если вам нужна поддержка или консультация по сканированию секретов, напишите мне на [email protected] 🚨 shhgit помогает прогрессивным командам разработки, эксплуатации и безопасности защищать свой код, находя секреты до того, как они приведут к утечке...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

debianopenssl

debianopenssl Clés privées vulnérables au bogue Debian OpenSSL CVE-2008-0166 En 2008, un bogue dans le paquet OpenSSL de Debian et d'Ubuntu a conduit à des clés privées prévisibles. Bien que le nombre de clés soit limité, quelques considérations sont nécessaires pour créer une liste appropriée de...

CVE-2019-14222

CVE-2019-14222: Standardzertifikat in Alfresco Community Alfresco Community 5.x und darunter wird standardmäßig mit einem Satz bekannter privater Zertifikate ausgeliefert. Jeder, der die Alfresco Community-Software auf einem lokalen Rechner herunterlädt und installiert, erhält Zugriff auf diese...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

DumpsterDiver

DumpsterDiver von @Rzepsky DumpsterDiver ist ein Werkzeug, das große Datenmengen nach fest codierten Geheimnissen wie Schlüsseln z.B. AWS Access Key, Azure Share Key oder SSH-Schlüssel oder Passwörtern durchsuchen kann. Zusätzlich ermöglicht es die Erstellung einfacher Suchregeln mit grundlegende...

EUVD-2026-63113

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

MAL-2026-13687 Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

CVE-2026-16957

The CVE describes a vulnerability in the Slim SEO WordPress plugin (pre-4.9.11) where a post-meta preview feature does not properly restrict access to posts a user can edit; it only checks read permission. As a result, users with the Contributor role (and higher) can read arbitrary post meta, inc...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...