offensive-azure

Microsoft Azure を標的とした攻撃用ツール集。Python で書かれており、プラットフォームに依存しません。現在のツール一覧とその機能の簡単な説明を以下に示します。 ./DeviceCode/devicecodeeasymode.py ターゲットユーザーに入力させるコードを生成します。 一般的なトークン生成や、フィッシング・ソーシャルエンジニアリングキャンペーンで使用できます。 ./AccessTokens/tokenjuggle.py 様々な方法でリフレッシュトークンを受け取り、指定されたリソースの新しいリフレッシュトークンとアクセストークンを取得します。...

leakScraper

leakScraper mongodb バージョン LeakScraperは、クレデンシャルを含む巨大なテキストファイルを処理し、可視化するための効率的なツールセットです。これらのツールは、ペンテスターやレッドチームがOSINT、クレデンシャル収集、クレデンシャルスタッフィング攻撃を行う際に役立つように設計されています。 インストール まず最初に：動作するmongodbサーバーを用意してください 。 その後： git clone -b mongodb https://github.com/Acceis/leakScraper cd leakScraper sudo ./install.s...

Python

Python...

TheCl0n3r

TheCl0n3r TheCl0n3rを使用すると、gitリポジトリのダウンロードと管理ができます。 はじめに 私の経験で使用するペネトレーションテストツールの約90%は、主にgithubで見つけることができます。このツールの目的は、これらのgitリポジトリのダウンロード、更新、削除を容易にすることです。新しいテストシステムに移行する場合、使用している同じツールセットを簡単に移行できるようにします。 使い方 GitHubを検索 現在インストールされているツールの一覧表示 GOバイナリのビルドとPythonツールのインストール 機能 リポジトリのダウンロード リポジトリの更新 リポジトリの...

RFIDIOt

/ RFIDIOt.py - RFID IO tools for python Adam Laurie [email protected] http://rfidiot.org/ This code is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or a...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1777586657)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777586657 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1772577130)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1772577130 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

PYSEC-2026-3533 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

CVE-2026-47392

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

PYSEC-2026-1266 Composio Code Injection Vulnerability

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

Malicious code in ue-python-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a6d9d874ce102a9ac674f8f713472a473007dc3d51adb869c5198afc708751 On import uepythontools, the package spawns a background thread that issues an HTTP POST to http://109.123.247.172/pypi carrying a JSON payload...

PYSEC-2026-486 PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Summary executecode in praisonaiagents.tools.pythontools defaults to sandboxmode="sandbox", which runs user code in a subprocess wrapped with a restricted builtins dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper blockedattrs, line 143 of pythontools.py...

GHSA-PV2J-RGHR-V5R9 PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder

Summary The executecode tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins. In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two...

[SECURITY] Fedora 44 Update: python-biopython-1.87-1.fc44

A set of freely available Python tools for computational molecular biology...

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Summary executecode in praisonaiagents.tools.pythontools defaults to sandboxmode="sandbox", which runs user code in a subprocess wrapped with a restricted builtins dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper blockedattrs, line 143 of pythontools.py...

Ethical-Hacking-Tools-Level2

🛡️ Cybersecurity & Python Portfolio - Level 2 Author: Pa...

[SECURITY] Fedora 43 Update: python-biopython-1.86-2.fc43

A set of freely available Python tools for computational molecular biology...

x86-exploitation-lab

It is an offensive tool for x86 exploitation. This repository co...

SVG Security Analysis Toolkit

SVG Security Analysis Toolkit contains specialized Python tools for analyzing potentially malicious SVG files and detecting security mechanisms...

CTFDefense

This repository, CTFDefense, contains tools for offline CTF Capture The Flag challenges. The tools are written in Python and are designed to monitor and analyze system events. The repository includes a script called SimpleMonitor.py, which uses the pyinotify library to watch for file system event...