GAMBA

GAMBA GAMBA は、混合ブール演算（MBA）式を簡略化するためのツールです。 GAMBA は General Advanced Mixed Boolean Arithmetic simplifier の略です。 線形代数に基づく簡略化器 SiMBA を使用して、非線形の入力 MBA に含まれる線形部分式を反復的に簡略化します。全体として、その中核となる要素は以下のとおりです。 抽象構文木（AST）の使用 （自明な、およびより高度な）変換を適用することによる線形部分式の分離 簡略化可能な線形部分式を構築する可能性を高めるためのリファクタリング SiMBA を用いた線形部分式の簡略化...

OSCP Notes and Custom Dashboard

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

stride-gpt

STRIDE GPT は、大規模言語モデル（LLM）を活用して、STRIDE 手法に基づき特定のアプリケーションの脅威モデルと攻撃ツリーを生成する AI 搭載の脅威モデリングツールです。ユーザーはアプリケーションの種類、認証方法、アプリケーションがインターネットに公開されているか、あるいは機密データを処理するかといったアプリケーションの詳細を提供します。モデルは提供された情報に基づいて出力を生成します。 目次 プロジェクトを支援する 機能 エンタープライズ展開 Open Security Summit での講演 変更履歴 インストール リポジトリ構成 使用方法 インタラクティブ REPL...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

cosa-nostra

Cosa Nostra Cosa Nostra는 악성코드 분석에 초점을 맞춘 오픈 소스 소프트웨어 클러스터링 툴킷입니다. 구조적으로 유사한 바이너리 악성코드 샘플의 계통수를 생성할 수 있습니다. SyScan360 Shanghai 2016에서 처음 공개되었습니다. 2016년부터 단 한 명의 사용자다행히 친구입니다를 위해 유지 관리하고 있습니다... 그냥 그러려니 하세요. 시작하기 필요한 타사 도구 Cosa Nostra를 사용하려면 Python 3.X 버전과 다음 도구 중 하나가 필요합니다코드 분석 수행용. IDA C++로 작성됨...

cosa-nostra

Cosa Nostra Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. I basically maintain it since 2016 for my one...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

combobulator

Dependency Combobulator Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks. This facilitates a holistic approach for ensuring secure application releases that can be evaluated against different sourc...

The_Automotive_Threat_Modeling_Template

背景 自動車関連技術の脅威モデリングワークショップには、カスタム要素、個別に調整された脅威、具体的な推奨事項を備えたDFDが必要です。自動車の脅威モデリング向けの専用テンプレートが存在しなかったため、Automotive Threat Modeling Template の開発に至りました。このテンプレートは、完全に新しいカスタマイズ済みテンプレートの作成を可能にする MS Threat Modeling Tool 2016 の新機能を活用しています。 Automotive Threat Modeling TM Template は Microsoft MS Threat Modelin...

drawio-threatmodeling

脅威モデリングのためのDraw.ioライブラリ これは、無料かつクロスプラットフォームのDraw.ioダイアグラム作成アプリケーションを、脅威モデリングに最適なツールへと変えるカスタムライブラリ集です。 データフロー図 データフロー図は、アプリケーションやシステム内でデータがどのように流れるのかを理解するために用いられる、シンプルなダイアグラミング技法です。DFDは、脅威モデリングを容易にするためにシステムを俯瞰するのに最適です。 攻撃ツリー...

Astra Linux – Vulnerability in Shadow

Shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

oscp-notes-2026 — Updated!

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

CVE-2026-59251

Summary: CVE-2026-59251 is a denial-of-service in Erlang/OTP public_key certificate path validation caused by unbounded growth of the certificate policy tree during RFC 5280 policy processing. The vulnerability occurs when validating TLS certificates; a chain with many policies per certificate ca...

Minima-private

Minima Minima is a blockchain with an emphasis on every user...

CVE-2026-63737

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

EUVD-2026-45908

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...

UBUNTU-CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

PT-2026-55271

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 25.3 through 29.0.2 Erlang/OTP versions 28.x prior to 28.5.0.3 Erlang/OTP versions 27.x prior to 27.3.4.14 ssl versions 10.9 through 11.7.2 ssl versions 11.6.x prior to 11.6.0.3 ssl versions 11.2.x prior to 11.2.12.10...