Kraken

一个基于Python的工具，用于集中和简化暴力破解攻击 关于本项目 Kraken 是一个强大的、基于Python的工具，旨在集中和简化各种暴力破解任务。Kraken 为网络安全专业人士提供了一套工具，可跨多种协议和服务高效执行暴力破解攻击。 ⚠️ 警告：法律免责声明 本工具仅供教育目的使用。作者不对任何非法使用本工具的行为负责。使用者应对自己的行为承担全部责任。 👀 截图 ⚙️ 安装 按照以下步骤安装 Kraken： root@kitploit: git clone https://github.com/jasonxtn/kraken.git cd Kraken pip install -r...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 爆弾 PoC CVE-2026-49975 の概念実証エクスプロイト。HTTP/2 サーバー実装におけるリモートサービス拒否の脆弱性です。Quang Luong Calif Security Research によって発見され、2026 年 6 月 2 日に公開されました。 許可されたセキュリティテストにのみ使用してください。所有していない、またはテストする書面による許可を得ていないインフラストラクチャに対して使用しないでください。 動作原理 この攻撃は、2 つの HTTP/2 プロトコルメカニズムを連鎖させます。 1. HPACK...

HTTP-2-Rapid-Reset-DDos

HTTP/2 快速重置 DoS 攻击 描述 本项目演示了如何使用 Containernet 创建自定义网络拓扑来实施 HTTP/2 快速重置拒绝服务（DoS）攻击。该攻击利用 HTTP/2 协议中的漏洞使目标服务器过载，从而使其无法响应。 拓扑 安装 要安装必要的软件包，请运行以下命令： root@kitploit: ./install.sh 要更改默认安装目录，可以像下面这样修改 INSTALLDIR 变量： root@kitploit: INSTALLDIR=/custom/path ./install.sh 用法 要启动基础设施，请运行以下命令： root@kitploit:...

PT-2026-62674

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can...

EUVD-2017-1498

Malware in sbrugna...

EUVD-2020-4277

Malware in sbrugna...

EUVD-2022-3486

Malicious code in bioql PyPI...

EUVD-2024-31255

Malicious code in bioql PyPI...

CVE-2024-31483

An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system...

CVE-2020-11940

In nDPI through 3.2 Stable, an out-of-bounds read in concathashstring in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library...

CVE-2018-16618

VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters...

CVE-2025-21613 go-git has an Argument Injection via the URL field

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only...

CVE-2024-21544

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace %20 before the file:// protocol, resulting in Local File Inclusion, which...

The vulnerability of the InnoDB component of the MySQL Database Server, which allows a hacker to cause a service failure

The vulnerability of the InnoDB component in the MySQL Database Management System is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures using the MySQL protocol...

The vulnerabilities of LOV components in terms of technical maintenance, repairs, and major overhauls of Oracle Complex Maintenance, Repair, and Overhaul systems—systems that enable attackers to gain access to read, modify, add, or delete data.

The vulnerability of LOV components in terms of technical maintenance, repairs, and major overhauls of Oracle system equipment exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or...

Vulnerability of the Server component: The Optimizer component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

Vulnerability of the Server component: The Optimizer component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

Vulnerability of the Server component: The DML of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to cause service interruptions using the MySQL protocol...

Irrevocable token holders can instantly mint a revocable token after burning and bypass the minimum XVS stake for revocable tokens

Lines of code Vulnerability details Impact When an irrevocable token is burned by the admin, the holder should go through the 90 day staking period again before accruing rewards. However, the holder can exploit the protocol to immediately begin accruing rewards after burning. Furthermore, the...

LockBit 3.0 Ransomware: Inside the Cyberthreat That's Costing Millions

U.S. government agencies have released a joint cybersecurity advisory detailing the indicators of compromise IoCs and tactics, techniques, and procedures TTPs associated with the notorious LockBit 3.0 ransomware. "The LockBit 3.0 ransomware operations function as a Ransomware-as-a-Service RaaS...