My-CVEs

Una lista de vulnerabilidades que encontré. Algunas vulnerabilidades incluyen análisis técnicos detallados, exploits o incluso tutoriales de sesiones de fuzzing. Algunas vulnerabilidades no tienen CVE porque los mantenedores me ignoraron, o porque un mantenedor no estuvo de acuerdo en que fuera u...

cbrutekrag

cbrutekrag 使用字典攻击对 SSH 服务器进行渗透测试。使用 C 语言编写。 brute krag 在南非荷兰语中意为“暴力破解” 免责声明 此工具仅用于道德测试目的。 cbrutekrag 及其所有者不对用户的滥用行为负责。 用户必须遵守当地法律的规定。 运行 root@kitploit: $ cbrutekrag -h | | | | | | | | | | | | / || ' | '| | | | / \ |/ / '/ |/ | | | | | | | || | || / | | | | | | | ||./|| ,|\||\| ,|, | OpenSSH...

cbrutekrag

cbrutekrag Penetration tests on SSH servers using dictionary attacks. Written in C. brute krag means "brute force" in afrikáans Disclaimer This tool is for ethical testing purpose only. cbrutekrag and its owners can't be held responsible for misuse by users. Users have to act as permitted by loca...

PasteJacker

PasteJacker The main purpose of the tool is automating PasteJacking/Clipboard poisoning/whatever you name it attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there's no tool doing this job the right way 😄 Now because thi...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

dnsx

Un conjunto de herramientas DNS rápido y multipropósito diseñado para ejecutar consultas DNS Características • Instalación • Uso • Ejecutar dnsx • Wildcard • Notas • Unirse a Discord dnsx es un conjunto de herramientas DNS rápido y multipropósito diseñado para ejecutar diversas sondas a través de...

Malimite

Description Malimite is an iOS and macOS decompiler designed to help researchers analyze and decode IPA files and Application Bundles. Built on top of Ghidra decompilation to offer direct support for Swift, Objective-C, and Apple resources. Features Multi-Platform Mac, Windows, Linux Direct suppo...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

Glass

Glass como en transparente y suave Un desensamblador interactivo rápido, nativo y centrado en aplicaciones móviles. Sucesor espiritual de IDA Pro para el flujo de trabajo de ingeniería inversa en Android / iOS, construido alrededor de: smali para manejo de APK / DEX / smali armv8-encode para...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

MyJWT

MyJWT codebeat badge Introducción Esta CLI es para pentesters, jugadores de CTF o desarrolladores. Puedes modificar tu jwt, firmar, inyectar, etc... Consulta la Documentación para más información. Si ves problemas o mejoras, envía un issue. Responderé lo antes posible. ¡Disfruta! : Documentación ...

Android-Projector-C2-Malware

Pre-installed C2 Infrastructure and RAT Payload on Android Projectors Technical Analysis Report — Security Research Affected Devices: Multiple Android projectors of beamer brands like the Nonete e.g., Model HY260Pro likely also several projectors from Magcubic, Hotack, Huyukang and many more, as...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

scorecard

OpenSSF Scorecard 概述 什么是 Scorecard? 知名 Scorecard 用户 查看项目评分 Scorecard 公开数据 使用 Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard 命令行界面 前置条件 安装 身份验证 基本用法 检查项 默认 Scorecard 检查项 检查项详细文档（评分标准、风险与修复措施） Scorecard 检查项初学者指南 其他重要建议 双因素认证 2FA 评分 综合评分 贡献 报告问题 行为准则 为 Scorecard 做贡献...

cloudsplaining

Cloudsplaining Cloudsplaining es una herramienta de evaluación de seguridad de AWS IAM que identifica violaciones del principio de mínimo privilegio y genera un informe HTML priorizado por riesgo. ' custom-guidance.html ' custom-appendices.html Generar informe con contenido personalizado...

cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report...

GHSA-CRVJ-82CR-HJCX Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...