offensive-azure

一组针对 Microsoft Azure 的攻击工具集合，使用 Python 编写以实现平台无关性。当前工具列表及其简要功能描述如下。 ./DeviceCode/devicecodeeasymode.py 生成一个供目标用户输入的代码 可用于通用令牌生成，或在钓鱼/社会工程攻击活动中使用。 ./AccessTokens/tokenjuggle.py 以多种方式接收一个刷新令牌，并为指定资源获取一个新的刷新令牌和一个访问令牌 ./AccessTokens/readtoken.py 接收一个访问令牌，解析其包含的声明信息，检查过期时间，并尝试验证签名...

leakScraper

leakScraper mongodb 版本 LeakScraper 是一套高效的工具集，用于处理和可视化包含凭证的巨型文本文件。这些工具旨在帮助渗透测试人员/红队成员进行 OSINT、凭证收集和凭证填充攻击。 安装 首要条件：有一个可用的 mongodb 服务器 。 然后： root@kitploit: git clone -b mongodb https://github.com/Acceis/leakScraper cd leakScraper sudo ./install.sh 它会安装一些 pip 包和 debian 包（python-magic、python3-pymongo...

TheCl0n3r

TheCl0n3r TheCl0n3r 允许你下载和管理你的git仓库。 前言 在我经验中，大约90%的渗透测试工具主要来源于GitHub。本工具旨在简化这些git仓库的下载、更新和删除操作。如果迁移到新的测试系统，可以更简单地转移正在使用的相同工具集。 用法 搜索GitHub 列出当前已安装的工具 构建GO二进制文件并安装Python工具 功能 下载仓库 更新仓库 删除仓库 搜索GitHub仓库 安装Go和Python工具 保持一切井井有条 包含一些基础工具以便快速入门 快速设置...

Python

Python...

RFIDIOt

/ RFIDIOt.py - RFID IO tools for python Adam Laurie [email protected] http://rfidiot.org/ This code is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or a...

PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

CVE-2026-47392

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

PYSEC-2026-1266 Composio Code Injection Vulnerability

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

Malicious code in ue-python-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a6d9d874ce102a9ac674f8f713472a473007dc3d51adb869c5198afc708751 On import uepythontools, the package spawns a background thread that issues an HTTP POST to http://109.123.247.172/pypi carrying a JSON payload...

PYSEC-2026-486 PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Summary executecode in praisonaiagents.tools.pythontools defaults to sandboxmode="sandbox", which runs user code in a subprocess wrapped with a restricted builtins dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper blockedattrs, line 143 of pythontools.py...

GHSA-PV2J-RGHR-V5R9 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

[SECURITY] Fedora 44 Update: python-biopython-1.87-1.fc44

A set of freely available Python tools for computational molecular biology...

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Summary executecode in praisonaiagents.tools.pythontools defaults to sandboxmode="sandbox", which runs user code in a subprocess wrapped with a restricted builtins dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper blockedattrs, line 143 of pythontools.py...

Ethical-Hacking-Tools-Level2

🛡️ Cybersecurity & Python Portfolio - Level 2 Author: Pa...

[SECURITY] Fedora 43 Update: python-biopython-1.86-2.fc43

A set of freely available Python tools for computational molecular biology...

x86-exploitation-lab

It is an offensive tool for x86 exploitation. This repository co...

SVG Security Analysis Toolkit

SVG Security Analysis Toolkit contains specialized Python tools for analyzing potentially malicious SVG files and detecting security mechanisms...

CTFDefense

This repository, CTFDefense, contains tools for offline CTF Capture The Flag challenges. The tools are written in Python and are designed to monitor and analyze system events. The repository includes a script called SimpleMonitor.py, which uses the pyinotify library to watch for file system event...

Banana Squad Hides Data-Stealing Malware in Fake GitHub Repositories

Banana Squad hid data-stealing malware in fake GitHub repos posing as Python tools, tricking users and targeting sensitive info like browser and wallet data...

MGASA-2025-0054 Updated python-twisted packages fix security vulnerabilities

Twisted.web has disordered HTTP pipeline response. CVE-2023-46137 Twisted.web has disordered HTTP pipeline response. CVE-2024-41671 HTML injection in HTTP redirect body. CVE-2024-41810...