yasuo

YASUO @0xsauby Description Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise th...

sidedoor

sidedoor sidedoor maintains an SSH connection or tunnel with a shell script daemon. The primary use case is maintaining a remote port forward to the local SSH server or another port. Thus, the local device can be accessed without using incoming connections that may be blocked by a NAT or firewall...

telegram-c2

Telegram C2 Telegramボットを介してサーバーをコマンド＆コントロールします。 インストール チュートリアル動画 Telegramボットを作成する main.pyを編集し、BOTAPIKEYにボットのAPIキーを、telegramuseridに自分のTelegram IDを設定する 以下の依存関係をインストールする pip install -r requirements.txt デプロイを容易にするため、スタンドアロンバイナリにコンパイルする pip install -U pyinstaller pyinstaller main.py ターゲットにデプロイする...

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

sshtunnel

|CircleCI| |AppVeyor| |readthedocs| |coveralls| |version| |pyversions| |license| Author : Pahaz Repo : https://github.com/pahaz/sshtunnel/ Inspired by https://github.com/jmagnusson/bgtunnel, which doesn't work on Windows. See also: https://github.com/paramiko/paramiko/blob/master/demos/forward.py...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py の再実装 最初のパストラバーサル悪用後のリモートサーバーのクラッシュを避けるため、リクエストするファイル名の一部に uuid を使用します。 run.py / shell.py: ローカルコンテナを実行するための podman 上のラッパー...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

CVE-2022-29464

Exploit CVE-2022-29464 此仓库包含用于利用 CVE-2022-29464 漏洞的脚本，该漏洞允许将文件上传到易受攻击的服务器。仅限在授权环境且用于教育目的。 依赖要求 Python 3.8 或更高版本 安装 步骤1：克隆仓库 从 GitHub 克隆仓库 git clone https://github.com/c1ph3rbyt3/CVE-2022-29464.git cd CVE-2022-29464 步骤2：安装依赖 pip install -r requirements.txt 脚本用法 脚本提供两种主要模式： 1. 处理单个主机。 2. 从文件处理主机列表。...

CVE-2014-6271

CVE-2014-6271 Bash Shellshock（及Aftershock）漏洞 Ansible 检测工具 1. 安装 Ansible http://docs.ansible.com/introinstallation.html 2. 将服务器添加到清单文件（示例）： username@ip 3. 将您的公钥复制到远程服务器的 .ssh/authorizedkeys 文件中 4. 执行测试 $ ansible-playbook -i inventory site.yml...

CVE-2023-23752

CVE-2023-23752 用バイナリ 倫理的および教育的目的のみに使用してください 😉 使い方 CVE-2023-23752 -u http://someserverexample.com ソースからビルド Go Go がインストールされている場合は、以下を実行します: git clone https://github.com/gunzf0x/CVE-2023-23752.git cd CVE-2023-23752 go run main.go -u http://someserverexample.com ライセンス MIT...

CVE-2023-39141-LFI-enumerator

CVE-2023-39141を悪用してリモートサーバーのファイルを列挙する POCを参照: https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e...

CVE-2025-6514

mcp-remote 将仅支持本地（stdio）服务器的 MCP 客户端连接到远程 MCP 服务器，并支持身份验证： 注意：这是一个可用的概念验证 ，但应被视为实验性 。 为什么需要它？ 到目前为止，大多数 MCP 服务器都通过 stdio 传输在本地安装。这样做有一些好处：客户端和服务器可以隐式信任彼此，因为用户已授予它们运行权限。添加 API 密钥等机密信息可以使用环境变量来完成，并且永远不会离开你的机器。此外，基于 npx 和 uvx 构建还可以让用户避免显式的安装步骤。...

Security Bulletin: WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: WebSphere Application Server, which is bundled with IBM WebSphere Remote Server, is affected by a privilege escalation (CVE-2026-11545)

Summary WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

PT-2026-96124

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description An unrestricted file upload issue exists in the core/modules/media.php file. Remote authenticated users with access to the Media Manager panel can upload files of dangerous types to execute arbitrary code...

EUVD-2026-81696

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

OESA-2026-3733 git security update

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...

Astra Linux - Vulnerability in Squid

A vulnerability was discovered in Squid 4.x versions prior to 4.15 and 5.x versions prior to 5.0.6. If a remote server sends a specific response header via HTTP or HTTPS, it results in a denial of service. This header could plausibly occur in normal network traffic...

Astra Linux – Vulnerability in Python 3.7, Python 2.7

A flaw was discovered in Python. Improper handling of HTTP responses in the Python HTTP client code may allow a remote attacker, who controls the HTTP server, to cause the client script to enter an infinite loop, consuming CPU resources. The greatest threat of this vulnerability is to system...

CVE-2026-78254

A flaw was found in Apache Ant. The ftp and scp tasks, used for downloading files, are vulnerable to a path traversal issue. A malicious remote server can exploit this by providing specially crafted relative paths, allowing it to write files outside the intended download directory. This could lea...