CVE-2025-32433

Erlang/OTP SSH CVE-2025-32433 に関するセキュリティ研究 Python エクスプロイト Proof-of-Concept CVE-2025-32433 Erlang/OTP SSH における未認証リモートコード実行。また、バナー取得用 Nuclei テンプレート と Nuclei RCE チェックも用意しています。 Suricata と Zeek IDS のログは、成功した Paramiko 攻撃、通常の OpenSSH9.8 接続（攻撃なし）2回、ProDefense/CVE-2025-32433 を使用した成功した攻撃2回、および...

suricata-script

このリポジトリには README がありません。...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy 针对 CVE-2025-59287 WSUS 的防御性概念验证诱饵。该诱饵在 8530 和 8531 端口模拟 WSUS Web 端点，捕获完整的 HTTP 请求体和请求头，存储证据以供取证分析，并包含一个 Windows 测试工具，用于验证端点、文件和进程遥测。它还包含示例检测规则（KQL 和 Suricata）以及一个 Sentinel 剧本模板。 重要提示：本项目严格用于防御目的。它不包含任何漏洞利用代码。仅在隔离的实验环境或分段测试环境中运行。除非您了解相关风险并已部署监控措施，否则请勿将诱饵暴露在生产网络中。 仓库内容 用于将类似 WSUS...

CVE-2026-45767

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A highly privileged remote attacker could exploit this vulnerability by crafting a malicious rule. When this rule is loaded or reloaded, it could allow...

CVE-2026-46352

A flaw was found in Suricata. Suricata's IP defragmentation code could deadlock when processing fragmented network traffic that contains an encapsulated tunnel protocol whose payload is also fragmented. This could allow a remote attacker to cause a Denial of Service DoS by making the system...

DEBIAN-CVE-2026-46352

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

EUVD-2026-80940

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-46352

Suricata 's IP defragmentation code (versions 8.0.0 through

CVE-2026-46352 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2023-46604-LAB

CVE-2023-46604 – Apache ActiveMQ RCE OpenWire Protocol 此仓库记录了一个用于理解和检测影响Apache ActiveMQ的CVE-2023-46604漏洞的实验室环境。 此项目的目标： 了解攻击行为在协议层面的表现 捕获恶意的OpenWire流量 使用Suricata构建检测规则 记录步骤，用于教育和防御安全用途 ⚠️ 重要提示 ：此仓库仅供教育和防御安全目的。 此处不包含攻击代码。仅包含实验室搭建、检测和缓解步骤。 目录 实验室网络拓扑 ActiveMQ安装笔记 Wireshark检测步骤 Suricata IDS规则与配置...

wazuh-home-soc

ホームSOC: Wazuh + Suricata を用いた脅威検知ラボ あえて脆弱性のあるターゲットに対して実際の攻撃手法を検知するために構築された、自己ホスト型セキュリティ運用センター（SOC）ラボ。Wazuh を SIEM、Suricata をネットワークベースの IDS センサーとして使用。ツールの導入だけでなく、検知エンジニアリングのスキルを示すために設計されている。 概要 現代の SOC 活動は、「SIEM...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Suricata-Update vulnerability (USN-8766-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8766-1 advisory. Guillem Lefait discovered that Suricata-Update did not properly validate destination paths when extracting files referenced by downloaded...

dmz-security-monitoring-hardening

DMZ 安全监控与加固 CY376：网络监控、安全与审计——期末项目 蓝队 | 塔夸矿业技术大学 作者： Kennedy Kumi Holomah 学号： FCM.41.018.148.23 学生 ID： 9013004623 概述 本项目在完全隔离的 VMware Workstation 实验环境中，构建、加固并监控一个非军事区（DMZ），其中托管着一台面向公众的 Ubuntu/Apache Web 服务器，其后端为 pfSense 防火墙。该项目作为塔夸矿业技术大学...

CVE-2026-45765

A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service. Mitigation Disable DNP3 parsing in the Suricata...

CVE-2026-45764

A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially...

CVE-2026-45769

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A remote attacker can exploit this vulnerability by sending repeated crafted User Datagram Protocol UDP traffic to the IKEv2 parser. This can cause the...

CVE-2026-45766

A flaw was found in Suricata, a network Intrusion Detection System. Insufficiently bounded Network File System NFS parser state structures can be exploited by a remote attacker sending crafted NFS traffic. This can cause Suricata to consume excessive memory, leading to a denial of service...

CVE-2026-45768

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. The LDAP Lightweight Directory Access Protocol transaction state could store an unbounded number of responses. A remote attacker could send crafted UDP User...