dicozorus

Dicozorus Dicozorus is a tool to generate and maintain web wordlists. It eliminates the overhead of managing multiple wordlists by storing paths enriched with metadata in a local SQLite database. Just want a great wordlist without the tool? Skip the setup and use lazy.txt. Why Dicozorus? Standard...

HopLa

HopLa - Burp copilot 💥 All the power of PayloadsAllTheThings, without the overhead. This extension enhances Burp Suite with intelligent autocompletion and built-in payloads to simplify intrusion testing. It supports integration with AI providers like Ollama, OpenAI, and Gemini to offer advanced...

CTF-Write-ups

CTF-Write-ups Some CTF Write-ups Follow us on...

bbs

BBS The old bbs can be found here Description bbs is a router for SOCKS and HTTP proxies. It exposes SOCKS5, HTTP CONNECT or port forwarding services and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script if built...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

cve-2023-29360

CVE-2023-29360 的 PoC 针对 MSKSSRV.SYS 驱动的利用程序 注意 如果你有任何能改进此利用程序的酷炫技巧或建议，我都很乐意接受 : 致谢 来自 Synacktiv @Synacktiv 的 Thomas Imbert @masthoon...

OUned

OUned El proyecto OUned, una herramienta de explotación que automatiza el abuso de las ACL de Unidades Organizativas mediante la manipulación de gPLink. Para una explicación detallada sobre el principio en el que se basa el ataque, la configuración necesaria y el uso de la herramienta, puede...

pcapan

pcapan Un asistente de análisis de capturas pcap Uso: root@kitploit: $ git clone https://github.com/synacktiv/pcapan $ cd pcapan $ cargo run -- --pcap /tmp/capture.pcap --google -w whitelist.yaml Finished dev unoptimized + debuginfo targets in 0.04s Running target/debug/pcapan --pcap...

synacktiv-rules

synacktiv-rules Public repository of Sigma and YARA/YARA-X rules created by Synacktiv. All rules in this repository should be considered tagged as TLP:CLEAR and PAP:CLEAR. Prerequisites When using a Sigma rule, please make sure that you collect and correctly parse required logs as defined in the...

Prox-Ez

Prox-Ez: La navaja suiza de la autenticación HTTP Este proxy HTTP gestiona todas las autenticaciones HTTP en tu nombre. Es compatible con NTLM EPA enlace de canal y enlace de servicio, kerberos, pass-the-hash, overpass-the-hash pass-the-key y pass-the-ticket TGT y TGS. Artículos relacionados:...

php_filter_chains_oracle_exploit

PHP filter chains: file read from error-based oracle A CLI to exploit parameters affected by the file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions, such as file, hashfile, filegetcontents or...

hexalocker-analysis

HexaLocker ransomware analysis This repository contains resources related to the analysis made on HexaLocker and available on this blog post: https://www.synacktiv.com/publications/lapsus-is-dead-long-live-hexalocker.html. a YARA rule to detect other HexaLocker samples. a list of HexaLocker hashe...

HP ILO 4 1.00-2.50 Authentication Bypass Administrator Account Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation', 'Description' = %q This module exploits an authentication bypass in HP...

Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware

A pair of recently disclosed zero-day flaws in Ivanti Connect Secure ICS virtual private network VPN devices have been exploited to deliver a Rust-based payload called KrustyLoader that's used to drop the open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as...

Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

Cisco has released patches to address a critical security flaw impacting Unified Communications and Contact Center Solutions products that could permit an unauthenticated, remote attacker to execute arbitrary code on an affected device. Tracked as CVE-2024-20253 CVSS score: 9.9, the issue stems...

Backup Migration < 1.3.8 - Unauthenticated RCE

Description The plugin is vulnerable to Remote Code Execution via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated...

Exploit for Untrusted Pointer Dereference in Microsoft

PoC for CVE-2023-29360 Exploit targeting MSKSSRV.S...

Snappy PHAR deserialization vulnerability

Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the phar:// wrapper...

Hacks at Pwn2Own Vancouver 2023

An impressive array of hacks were demonstrated at the first day of the Pwn2Own conference in Vancouver: On the first day of Pwn2Own Vancouver 2023, security researchers successfully demoed Tesla Model 3, Windows 11, and macOS zero-day exploits and exploit chains to win $375,000 and a Tesla Model ...

GHSA-72P8-V4HG-V45P Weak private key generation in SSH.NET

During an X25519 key exchange, the client’s private is generated with System.Random: cs var rnd = new Random; privateKey = new byteMontgomeryCurve25519.PrivateKeySizeInBytes; rnd.NextBytesprivateKey; Source: KeyExchangeECCurve25519.cs Source commit:...