Webkiller v2.0 - Tool Information Gathering

Tool Information Gathering Write With Python. PreView ██╗ ██╗███████╗██████╗ ██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██║ ██║██╔════╝██╔══██╗██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ ██║ █╗ ██║█████╗ ██████╔╝████&9608 ;╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██║███╗██║██╔══╝ ██╔══██╗██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗...

shadowbroker-1

This repository, fengzihk/shadowbroker-1, contains a collection of exploits and tools leaked by the Shadow Brokers, a group known for releasing sensitive information. The repository includes a README file that lists various exploits, such as EARLYSHOVEL, EBBISLAND, ECHOWRECKER, EASYBEE, and...

PSKernel-Primitives

This repository contains a collection of PowerShell primitives for fuzzing and exploitation. The primitives are designed to be used in a Windows environment and are intended for use in red teaming and penetration testing. The repository includes the following primitives: 1. Alloc-NullPage.ps1:...

Applied ThreadFix: Automated Vulnerability Exception Reporting

One of the most valuable things about ThreadFix is that it centralizes the results of all your testing, assurance, and remediation activities so you no longer have separate silos of data. This is really valuable from a reporting standpoint. If you need to you can drill down into specific parts of...

Ninja - Open Source C2 Server Created For Stealth Red Team Operations

Ninja C2 is an Open source C2 server created by Purple Team to do stealthy computer and Active directoty enumeration without being detected by SIEM and AVs , Ninja still in beta version and when the stable version released it will contains many more stealthy techinques and anti-forensic to create...

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

This module exploits a command injection vulnerability in the tdpServer daemon /usr/bin/tdpServer, running on the router TP-Link Archer A7/C7 AC1750, hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attacker on the LAN side of the route...

acymailing, 6.9.2,Other

acymailing, 6.9.2,Other Update to version 6.9.2 Developer did not inform the VEL team...

Product Lister for Walmart <= 1.0.0 - Unauthenticated RCE via Outdated PHPUnit

The plugin uses an outdated PHPUnit library, which is known to be affected by an unauthenticated RCE issue. February 28th, 2020 - Ticket sent to vendor via https://support.cedcommerce.com/open.php March 6th, 2020 - Update requested to vendor also realised that the ticket was closed w/o reason giv...

Product Lister for Walmart <= 1.0.0 - Unauthenticated RCE via Outdated PHPUnit

The plugin uses an outdated PHPUnit library, which is known to be affected by an unauthenticated RCE issue. February 28th, 2020 - Ticket sent to vendor via https://support.cedcommerce.com/open.php March 6th, 2020 - Update requested to vendor also realised that the ticket was closed w/o reason giv...

GHSA-VG44-FW64-CPJX Incorrect Account Used for Signing

Impact Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account i.e. the account at index 0, or with the legacy MEW/MyCrypto HD path, they are not affected. The vulnerability impacts cases where the user sign...

The vulnerabilities of Azure DevOps Server and Team Foundation Server software allow attackers to enhance their privileges.

The vulnerabilities of Azure DevOps Server and Team Foundation Server software allow attackers to exploit object processing errors. Exploiting these vulnerabilities can enable remote attackers to gain increased privileges...

ManageEngine Applications Manager License Key Disclosure

License key disclosure vulnerability in ManageEngine Applications Manager Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

[サイバーセキュリティ月間2020] マイクロソフトのセキュリティに関する情報発信サイトのまとめ

わたしたちセキュリティレスポンスチームは、日本政府が定める「サイバーセキュリティ月間」に賛同し、本ブ...

UPDATE: FudgeC2 0.5.5

FudgeC2 0.5.5 was released recently. As you may remember, this awesome adversary emulation system was listed in my older post titled – List of Open Source C2 Post-Exploitation Frameworks and FudgeC2 0.5.4. This newer version allows you to screenshot the desktop of any hosts with an implant. What ...

Team Password Manager Cross-Site Scripting Vulnerability

Team Password Manager is a web-based team password manager. A cross-site scripting vulnerability exists in Team Password Manager 7.93.204 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

CVE-2019-19461

Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title...

CVE-2019-19461

Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title...

Cross site scripting

Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title...

CVE-2019-19461

Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title...

CVE-2019-19461

CVE-2019-19461 affects Team Password Manager (up to version 7.93.204 and earlier). The root cause is described as a cross-site scripting vulnerability resulting from insufficient validation of client-side data, enabling post-authentication stored XSS. An attacker can steal other users’ credential...