SQLRecon

SQLRecon SQLRecon è un toolkit per Microsoft SQL Server progettato per ricognizione offensiva e post-sfruttamento. Per informazioni dettagliate su come utilizzare ogni tecnica, fare riferimento alla wiki. Puoi scaricare una copia di SQLRecon dalla pagina releases. In alternativa, sentiti libero d...

edge

Cloud edge - Whois per il Cloud Cerca un IP per trovare il provider cloud e altri dettagli basandosi sui dati JSON, CSV o di testo pubblicati dal provider Cloud edge è uno strumento di ricognizione focalizzato sull'esplorazione dei provider di servizi cloud. Può essere utilizzato per l'attribuzio...

powerfulseal

PowerfulSeal PowerfulSeal injiziert Fehler in Ihre Kubernetes-Cluster, damit Sie Probleme so früh wie möglich erkennen können. Es ermöglicht, Szenarien zu schreiben, die vollständige Chaos-Experimente beschreiben. Begrüßen Sie das unvermeidliche Scheitern. Begrüßen Sie den Seal. Dokumentation Bit...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

tko-subs

tko-subs Questo strumento permette: Verificare se un sottodominio può essere preso in possesso perché ha: un CNAME pendente che punta a un provider CMS Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, ecc. che può essere preso in possesso. un CNAME pendente che punta a un nome di dominio...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop versions through 1.0.2b6 are vulnerable to a missing authorization flaw (CWE-862). Authenticated users with low privileges can access the GET /api/providers and GET /api/voice/providers endpoints, which only validate the JWT without sufficient permission checks. This allows att...

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

EUVD-2026-96364

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

Abused-Legitimate-Services

Servizi Legittimi Abusati I fornitori terzi legittimi di Platform-as-a-Service PaaS vengono sempre più sfruttati dagli attori delle minacce per phishing e distribuzione di malware. Fornitori PaaS come istanze cloud, piattaforme di marketing, reti di distribuzione dei contenuti CDN e server DNS...

pentestcode

PentestCode Agente di penetration testing basato su AI nel tuo terminale. Architettura multi-agente • Tracciamento dello stato dell'engagement • Oltre 20 provider LLM PentestCode è un agente di pentesting autonomo per il tuo terminale. Puntalo verso un target e lui esegue i tool, legge l'output,...

burp-vps-proxy

Burp VPS Proxy: Einfache Cloud-Proxys für Burp Suite Erste Schritte » Funktionen · Anbieter · Haftungsausschluss 📖 Über Burp VPS Proxy ist eine Burp-Suite-Erweiterung, die das automatische Erstellen und Löschen von vorgelagerten SOCKS5-Proxys bei bekannten Cloud-Anbietern direkt aus Burp Suite...

OWASP-Top-10-Neocloud-and-AI-Data-Center-Security-Risks

The Top 10 Neocloud and AI Data Center Security Risks FORGE - Harden the metal beneath the model. 🌐 Website: https://forge-framework.io Executive Summary AI workloads depend on complex infrastructure spanning accelerators, high-speed networks, storage, orchestration platforms, identity systems,...

cloud_ip_ranges

Intervalli IP del Cloud Descrizione La maggior parte dei provider cloud pubblica elenchi aggiornati dei propri intervalli di indirizzi IP. Questo strumento identifica se un IP appartiene agli intervalli di un provider recuperando ed analizzando gli elenchi più recenti. Supporta: AWS fonte Azure...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2025-69219

CVE-2025-69219 — Apache Airflow Providers HTTP RCE tramite deserializzazione Pickle non sicura Gravità: Alta CVSS 3.1: 8.8 Vettore: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: CWE-913 — Controllo improprio delle risorse di codice dinamicamente gestite Interessati: apache-airflow-providers-http =...

CVE-2026-63270 Environment/ini-file leaks

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...