cloud-doctor

cloud-doctor 一条命令即可评估您的整个云账户——错误配置、缺失的可观测性以及安全态势，并按优先级列出前五项需要修复的问题。 将它指向 AWS、Cloudflare、Vercel、Supabase、Render、Fly.io 或 Railway，它就会返回一个评分、哪些地方出了问题以及每个问题的修复方案——内容自包含，可直接交给 Agent 处理。 快速开始 root@kitploit: npx cloud-doctor https://github.com/user-attachments/assets/60b610ab-7aee-4c3a-8d9e-83f045c8cc56...

PhantomFS

PhantomFS ProjFS 提供程序。投影文件，其内容取决于哪个进程读取它们。有效载荷以 AES-256-CBC 加密存储在磁盘上，仅在运行时在内存中解密。这不应该绕过任何 EDR，因为当允许的进程尝试读取时，有效载荷会被写入磁盘。其他所有进程都会被拒绝访问。这可能会惹恼一些分析人员，因为他们的工具无法读取它，或者只是加载一个诱饵。但你可以很容易地通过重解析点看出这是 ProjFS。 工作流程 root@kitploit: 1 生成密钥： PhantomFS.exe -keygen 2 加密有效载荷： PhantomFS.exe -encrypt mimikatz.exe -key...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

AOSP-DownloadProviderDbDumperSQLiWhere

AOSP-DownloadProviderDbDumperSQLiWhere 利用Android下载提供程序选择参数中的SQL注入的PoC CVE-2019-2198 安全公告 Android AOSP 下载提供程序查询选择参数中的SQL注入 CVE-2019-2198 演示...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

phpBB < 3.3.17 - Authentication Bypass

phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...

Damn-Vulnerable-Android-Components

可恶的易受攻击的安卓组件 - DVAC 筛子重生！ 可恶的易受攻击的安卓组件（DVAC）是一款教育性安卓应用，专门暴露和演示与各种安卓组件（如 Activity、Intent、Content Provider 和 Broadcast Receiver）相关的漏洞。它被设计成一个密码管理器应用，用于安全地管理和存储密码（笑）。 受 Sieve 应用程序开创性工作的启发（该应用专注于类似漏洞，但已过时且与新版本安卓不兼容），DVAC 旨在填补空白，为学习安卓安全提供现代、最新的平台。DVAC...

TiEtwAgent

TiEtwAgent - 基于ETW的进程注入检测 这个项目是为了研究、构建和测试不同的内存注入检测用例和绕过技术而创建的。该代理利用 Microsoft-Windows-Threat-Intelligence 事件追踪提供程序，作为用户态挂钩的更现代、更稳定的替代方案，并具有内核模式可见性的优势。 该项目依赖于 microsoft/krabsetw 库进行 ETS 设置和使用。 随附的博文可在此处找到：https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection...

overlord

Overlord – Red Teaming Automation Overlord provides a python-based console CLI which is used to build Red Teaming infrastructure in an automated way. The user has to provide inputs by using the tool’s modules e.g. C2, Email Server, HTTP web delivery server, Phishing server etc. and the full infra...

saas_enum

SaaS Enum SaaS Enum es una herramienta de línea de comandos para descubrir las plataformas SaaS que una empresa puede estar utilizando. La herramienta busca registros DNS que coincidan con patrones de proveedores conocidos y, opcionalmente, realiza comprobaciones web ligeras para confirmar...

flask-saml2

flask-saml2 .. note:: 寻找维护者 。本项目已不再维护。该库在我上次使用时仍可正常工作， 但我已不再参与当初为其构建的项目。如果您有兴趣接管并维护此项目，请与我们联系。 .. image:: https://travis-ci.com/timheap/flask-saml2.svg?branch=master :target: https://travis-ci.com/timheap/flask-saml2 .. image:: https://badge.fury.io/py/flask-saml2.svg :target:...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 和 CVE-2024-46257 是同一个 POC，只需更改 provider 参数。 注意 有时 nc 文件无法在服务器上执行，或者无法执行命令！ 安装依赖 root@kitploit: pip install requests 运行漏洞利用 root@kitploit: python3 POCCVE-2024-46256.py + 目标类型 IP/主机? i/h: i + 输入 IP 或主机: IP/HOST + 输入端口: PORT + 输入用户名: USERNAME + 输入密码: PASS + 获取到的令牌:...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. root@kitploit: python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...

cloud-middleware-dataset

Conjunto de datos de middleware en la nube Este proyecto contiene el middleware en la nube es decir, agentes instalados por los proveedores de seguridad en la nube utilizado en los principales proveedores de servicios en la nube Azure, AWS y GCP. El conjunto de datos de middleware en la nube...

CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 fails to verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated attackers to take over any user account—including administrators—by asserting a victim's ...

CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...