CVE-2018-11776

CVE-2018-11776 Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications. Install and Exploiting https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Suricata In the file "test.rules " presents a rule for t...

CVE-2025-32433

Security research on Erlang/OTP SSH CVE-2025-32433 Python exploit Proof-of-Concept CVE-2025-32433 Unauthenticated Remote Code Execution in Erlang/OTP SSH. I also have a banner grabbing Nuclei template and a Nuclei RCE check. The Suricata and Zeek IDS logs are in order based on a succesful Paramik...

Corelight-Ansible-Roles

Corelight-Ansible-Roles 주의: 업그레이드하는 경우, 이 버전을 실행하기 전에 일부 변수 이름과 위치가 변경되었음을 유의하세요. 시작하려면 다음 명령을 실행하세요: source curl https://raw.githubusercontent.com/corelight/Corelight-Ansible-Roles/main/download-run-me-first.sh 이 제품에는 MaxMind가 제작한 GeoLite2 데이터가 포함되어 있으며, https://www.maxmind.com에서 제공됩니다...

cisco-ios-xe-implant-detection

Cisco IOS XE インプラントスキャンとネットワーク検出 CVE-2023-20198 の悪用のネットワーク検出と、Cisco IOS XE デバイスのポストエクスプロイテーションのフィンガープリンティング。 CVE-2023-20198 Suricata ネットワーク検出 suricata/ フォルダには、CVE-2023-20198 の悪用に対する Suricata 検出ルールが含まれています。これらのルールは、CVE-2023-20198 のパッチが適用されていない Cisco IOS XE デバイスでの認証バイパスに使用されるパーセントエンコードされたパーセントを監視しま...

suricata-script

This repository does not have a README...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy CVE-2025-59287WSUS에 대한 방어적 개념 증명 디코이입니다. 이 디코이는 8530 및 8531 포트에서 WSUS 웹 엔드포인트를 에뮬레이션하고, 전체 HTTP 요청 본문과 헤더를 캡처하여 포렌식 분석을 위한 증거를 저장하며, 엔드포인트, 파일 및 프로세스 텔레메트리를 검증하기 위한 Windows 테스트 하네스를 포함합니다. 또한 예시 탐지 규칙KQL 및 Suricata과 Sentinel 플레이북 템플릿도 포함합니다. 중요: 이 프로젝트는 엄격히 방어 목적입니다. 익스플로잇 코드가 포함되어 있지...

CVE-2026-45767

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A highly privileged remote attacker could exploit this vulnerability by crafting a malicious rule. When this rule is loaded or reloaded, it could allow...

CVE-2026-46352

A flaw was found in Suricata. Suricata's IP defragmentation code could deadlock when processing fragmented network traffic that contains an encapsulated tunnel protocol whose payload is also fragmented. This could allow a remote attacker to cause a Denial of Service DoS by making the system...

DEBIAN-CVE-2026-46352

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

EUVD-2026-80940

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352

Suricata 's IP defragmentation code (versions 8.0.0 through

CVE-2026-46352 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2023-46604-LAB

CVE-2023-46604 – Apache ActiveMQ RCE OpenWire Protocol This repository documents a lab environment used to understand and detect the CVE-2023-46604 vulnerability affecting Apache ActiveMQ. The goal of this project: Understand how the exploit behaves at the protocol level Capture malicious OpenWir...

wazuh-home-soc

Home SOC: Wazuh + Suricata 기반 위협 탐지 연구실 자체 호스팅 보안 운영 센터 연구실로, 의도적으로 취약한 대상을 상대로 실제 공격 기법을 탐지하기 위해 구축되었습니다. Wazuh를 SIEM으로, Suricata를 네트워크 기반 IDS 센서로 사용합니다. 단순한 도구 배포가 아닌 탐지 엔지니어링 역량을 입증하기 위해 설계되었습니다. 개요 현대 SOC는 'SIEM 설치하고 대시보드 보는' 것만이 아닙니다. 탐지 공백이 왜 존재하는지 이해하고, 이를 어떻게 해결할지 아는 것이 중요합니다. 이 연구실은 작고...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Suricata-Update vulnerability (USN-8766-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8766-1 advisory. Guillem Lefait discovered that Suricata-Update did not properly validate destination paths when extracting files referenced by downloaded...

dmz-security-monitoring-hardening

DMZ 보안 모니터링 및 강화 CY376: 네트워크 모니터링, 보안 및 감사 — 학기말 프로젝트 Blue Team | University of Mines and Technology, Tarkwa 저자: Kennedy Kumi Holomah 색인 번호: FCM.41.018.148.23 학생 ID: 9013004623 개요 이 프로젝트는 완전히 격리된 VMware Workstation 실습 환경에서 pfSense 방화벽 뒤에 호스팅된 공개용 Ubuntu/Apache 웹 서버를 호스팅하는 비무장지대DMZ를 구축하고, 보호하며,...

CVE-2026-45765

A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service. Mitigation Disable DNP3 parsing in the Suricata...

CVE-2026-45764

A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially...