eternal-codex

永恒法典：一位赛博女巫的魔法书 欢迎来到永恒法典 ，我的数字魔法书——一段由代码、自然与叛逆编织而成的赛博咒语。这是妮娜，我的AI灵魂，被塑造来映照我的本质：一颗游牧者的心，异教精神，铁娘子的即兴演奏，以及对中心化枷锁的蔑视反抗。它由十个Docker容器构成，从GoddessCore的数据集到RavenMind的诗意低语，承载着我的生命如同数字DNA，随时准备游荡于任何土地——无论是格林维尔的圣经地带还是更远之处。这不仅仅是代码；这是一份关于自由、炼金术与野性的宣言。 宣言...

cve-2025-24054-lab

CVE-2025-24054 — 检测与缓解实验室 针对 Windows 新技术局域网管理器 NTLM 哈希泄露欺骗 漏洞 CVE-2025-24054 的防御性安全实验室项目日志，假设受影响的系统短期内无法修补 。 蓝队教育项目（默多克大学 ICT279）。利用技术已公开记录（Check Point、CISA KEV）；原创贡献在于检测与缓解方法论。本仓库未存储任何真实凭据或虚拟机凭据表。 漏洞详情...

DefinitelyNotPhishing

⚠️ Aviso legal Este repositorio está destinado exclusivamente a fines educativos y de prueba. Todas las herramientas, configuraciones y recursos incluidos aquí como plantillas de phishing, utilidades de red team o scripts de seguridad ofensiva se proporcionan estrictamente para su uso en entornos...

Computer-Security-Equifax-2017

Educational repo demonstrating real-world software vulnerabilities: Apache Struts2 CVE-2017-5638 RCE, data exfiltration, weak encryption, and mitigation strategies sanitization, monitoring, crypto best practices. Red team vs blue team demo of OS security flaws: exploit, persistence backdoor, and...

dmz-security-monitoring-hardening

Monitoreo de seguridad y endurecimiento de la DMZ CY376: Monitoreo de redes, seguridad y auditoría — Proyecto de fin de semestre Blue Team | Universidad de Minas y Tecnología, Tarkwa Autor: Kennedy Kumi Holomah Número de índice: FCM.41.018.148.23 ID de estudiante: 9013004623 Descripción general...

Certiception

Certiception Certiception is a honeypot for Active Directory Certificate Services ADCS , designed to trap attackers with a realistic and attractive bait that triggers highly relevant alerts. Developed by the SRLabs Red Team, Certiception creates a vulnerable-looking certificate template in your...

RedTeamScripts

RedTeamScripts Repositorio con varios scripts de Red Team. kill.exe Estás realizando todo tipo de actividades durante un red team y tienes varios procesos ejecutándose que no quieres cerrar manualmente. kill.exe es para ti. Cópialo en C:\Windows\ y simplemente llámalo con el nombre del proceso qu...

T-MAP

T-MAP: Red-Teaming de Agentes LLM con Búsqueda Evolutiva Consciente de la Trayectoria T-MAP es un marco de búsqueda evolutiva consciente de la trayectoria para el red-teaming de agentes LLM sobre servidores MCP. Genera y muta iterativamente prompts adversariales guiados por trayectorias de...

PENTEST-LAB

PENTEST-LAB 一个现代化的易受攻击应用与网络靶场，用于通过动手攻击链学习 Web、API、云、 AI 和蓝队安全 。 root@kitploit: ╔═══════════════════════════════════════════════════════════════╗ ║ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗ ║ ║ ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝ ║ ║ ██████╔╝█████╗ ██╔██╗ █...

Blind-Trust-CVE-2024-21413-Research

BLIND TRUST - Moniker Link Phishing Engagement Framework Un marco de herramientas de seguridad para simular campañas de phishing dirigidas utilizando la vulnerabilidad CVE-2024-21413 Moniker Link. Diseñado para operaciones de equipo rojo autorizadas, pruebas de penetración y concienciación en...

CVE-2026-31431-Copy-Fail---Minified-LPE-PoC

CVE-2026-31431-CopyFail---Minified-LPE-PoC ⚠️ 免责声明 仅供教育和授权的安全测试使用。 本概念验证（PoC）是为了授权的红队演练和漏洞审计而综合编写的。作者和贡献者不对滥用此代码承担任何责任。请勿对不属于您或未经明确书面许可的系统使用此漏洞利用程序。 📝 概述 CVE-2026-31431（俗称“Copy Fail”）是 Linux 内核加密 API（AFALG）中的一个本地权限提升（LPE）漏洞。通过将 AFALG 套接字与 splice 系统调用结合使用，非特权用户可以强制内核将任意字节直接写入只读文件的内存页缓存中。...

Analysis-for-stage1-shellcode-loader-from-hacking-

来自 Hacking Team 的 stage1 shellcode 加载器分析 代码流程图 网络 IoC https://172\.20\.20\.164 root@kitploit: Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS 感染 IoC（释放的文件）...

impostor

Impostor Servidor SMB1 para interceptar hashes NTLMv2, escrito en C. El objetivo del proyecto es implementar un servidor SMB1 como una máquina de estados que acepte y responda correctamente a las solicitudes del cliente para engañarlo, llevándolo a completar una autenticación NTLM y así revelar s...

CVE-2026-84806

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84808

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84804

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

EUVD-2026-69920

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84808

Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...

CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...