stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

attackgen

AttackGen AttackGen은 대규모 언어 모델의 성능과 포괄적인 MITRE ATT&CK 및 ATLAS 프레임워크를 활용하는 사이버보안 사고 대응 테스트 도구입니다. 이 도구는 사용자가 선택한 위협 행위자 그룹, AI 공격 사례 연구, 그리고 조직의 세부 정보를 기반으로 맞춤형 사고 대응 시나리오를 생성합니다. 목차 Star the Repo Features Releases Requirements Installation LangSmith Setup Data Setup Running AttackGen MCP Server...

mimipenguin

MimiPenguin 2.0 A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. This was assigned CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Fun fact it's still not fixed after GNOME Keyring 3.27.2 and still works ...

superpowers-evals

Superpowers Evals 행동 평가 연구소 for superpowers. Quorum 는 실제 코딩 에이전트 CLI Claude, Codex, Antigravity, Gemini, Kimi, OpenCode, Pi, and Copilot를 Gauntlet QA 에이전트를 통해 구동하고 시나리오 승인 기준과 결정론적 사후 검사에 대해 평가합니다. 코드, CLI, 경로 및 인라인 텍스트는 모두 소문자 quorum을 사용합니다. 대문자 Quorum은 제목과 행위자 테이블에 나타납니다. 이것은 일반적인 벤치마크 스위트가 아닙니...

CVE-2022-30190

CVE-2022-30190 Microsoft Office Word Rce 再現 CVE-2022-30190 脆弱性の概要 MS Office の docx ファイルには、HTML ファイルとして外部 OLE オブジェクト参照が含まれる可能性があります。ms-msdt: という HTML シナリオが存在し、msdt 診断ツールを呼び出して、任意のコードを実行できます（パラメータで指定）。 結果として、悪意のある docx ファイルを開くだけで（マクロを使用せずに）RCE を獲得できる恐ろしい攻撃ベクトルとなります。 再現開始 Twitter で @naosec...

catsploit

CATSploit🐈 CATSploit is an automated penetration testing tool using Cyber Attack Techniques Scoring CATS method that can be used without pentester. Currently, pentesters implicitly made the selection of suitable attack techniques for target systems to be attacked. CATSploit uses system...

Phishing-Simulation

Phishing-Simulation Phishing Simulation은 직관적인 튜토리얼과 맞춤형 평가실제 설정 없이 - 도메인, 인프라, 실제 이메일 주소 없이를 제공하여 사람들이 주어진 상황에서 어떤 행동을 할지 평가하고 현재 인식 상태를 이해할 수 있게 함으로써 피싱 인식을 높이는 것을 주 목적으로 합니다. 무엇? 레드팀 평가를 수행하는 조직의 목표 중 하나는 사람과 네트워크를 포함한 IT 생태계의 취약점을 파악하는 것입니다. 조직은 경계 보안을 개선하고 발견된 취약점을 패치하기 위해 모든 노력을 기울이지만, 사람이 여...

shfz

shfz 시나리오 기반 웹 애플리케이션 퍼징 도구로, 유전 알고리즘을 통한 퍼즈 생성을 지원합니다. 특징 쉽게 커스터마이즈 가능 – JavaScript/TypeScript로 퍼징 시나리오를 스크립팅하여 테스트 서드파티 패키지 – 퍼징 시나리오 스크립트에서 사용 가능 유전 알고리즘 기반 퍼즈 생성으로 코드 커버리지 향상 CI와의 높은 친화성 – 자동으로 GitHub 이슈에 보고서 게시 트레이서의 자동 오류 탐지 로 버그 수정 지원 설치 Releases 페이지에서 바이너리를 다운로드하거나 소스에서 컴파일하세요. Linux amd6...

FinRED-paper

FinRED: An Expert-Guided Benchmark Generation and Evaluation Framework for Financial LLM Red-Teaming IEEE ICDM 2026 A red-team benchmark generation pipeline for safety evaluation in the financial domain. Supplementary Documentation Detailed materials referenced in the paper:...

CVE-2025-53632

CVE-2025-53632 此仓库包含一个针对 CVE-2025-53632 的利用 ，影响 Chall-Manager !WARNING Chall-Manager 处理场景的方式仍完全可被利用，无需 zip slip：只需篡改场景中的 pulumi 二进制文件，使得下一次执行时运行您的任意代码。 我们演示针对 Chall-Manager v0.1.3 的攻击。 场景 假设有一个暴露的 Chall-Manager（请不要这样做，因为它本意并非如此——它是一个按需 RCE 应用）。 创建挑战时，场景通过 Pulumi 预览进行验证。对此代码没有控制权，因此我们可以注入任何内容 。...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: The free copynotify stateid in nfs4freeolstateid has been fixed. Typically, the copynotify stateid is freed either when the parent’s stateid is being closed/freed, or in nfsd4laundromat if the stateid has not been used for ...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Memory leaks have been fixed in checkfunccall. kmemleak reports this issue: Unreferenced object 0xffff88817139d000 size 2048: comm "testprogs", pid 33246, jiffies 4307381979 age 45851.820s Hex dump first 32 bytes: 01 00 0...

ROS-20260910-73-0159

The vulnerability of the xmtparsecommand function in the MP4Box multimedia platform’s utility involves the use of memory after it is freed during the processing of an incorrect XMT scenario. This allows a malicious actor to cause a service failure...

ROS-20260910-73-0166

The vulnerability of the xmtparsecommand function in the MP4Box multimedia platform’s utility involves the use of memory after it is freed during the processing of an incorrect XMT scenario. This allows a malicious actor to cause a service failure...

CS-Guard: Benchmarking LLM Guardrails for Code Generation Security

Large language models LLMs have been ex- ploited to generate malware, but the effective- ness of guardrails for code generation secu- rity remains unclear. We introduce CS-Guard, the first benchmark to systematically evalu- ate guardrails for code generation security. It covers 1 text-to-code...

Cybersecurity IR Workshop: The workshop you shouldn’t miss

In this article 1. What is the Cybersecurity Incident Response Readiness Workshop? 2. Our approach: How we assess your maturity 3. Learn more Cybersecurity incidents can unfold in hours, but response plans often fail at the point of execution: ownership is unclear, investigation findings is...

Cybersecurity IR Workshop: The workshop you shouldn’t miss

In this article 1. What is the Cybersecurity Incident Response Readiness Workshop? 2. Our approach: How we assess your maturity 3. Learn more Cybersecurity incidents can unfold in hours, but response plans often fail at the point of execution: ownership is unclear, investigation findings is...

CVE-2026-82747

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

EUVD-2026-68966

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

CVE-2026-82747

CVE-2026-82747 is an Incorrect Authorization vulnerability in ash-project ash (Elixir API framework), affecting versions 3.4.44 through 3.32.1 . The bug resides in Ash.Policy.Authorizer (lib/ash/policy/authorizer/authorizer.ex): when a resource uses an access_type: :runtime read policy, the check...