reverse-shell

reverse-shell リバースシェルをサービスとして提供 - https://reverse-shell.sh 覚えやすいリバースシェル。ほとんどのUnix系システムで動作します。 ターゲット上で利用可能なソフトウェアを検出し、適切なペイロードを実行します。 使い方 1. 接続を待ち受ける あなたのマシンでポートを開けて待ち受けます。netcatで簡単にできます。 root@kitploit: nc -l 1337 2. ターゲットでリバースシェルを実行する ターゲットマシンで、https://reverse-shell.sh/yourip:port の出力をshにパイプします。...

lynis

ドキュメント このソフトウェアは好きですか？プロジェクトにスターを付け てスターゲイザーになりましょう。 lynis Lynis - UNIXベースシステム向けのセキュリティ監査および堅牢化ツール。 LynisはLinux、macOS、BSDなどを含むUNIXベースのシステム向けのセキュリティ監査ツールです。システム自体で実行され、詳細なセキュリティスキャン を実施します。主な目的はセキュリティ防御をテストし、さらなるシステム堅牢化のためのヒント...

punk.py

punk.py unix SSH 후-침투 1337 도구 작동 방식 punk.py는 손상된 unix 박스에서 네트워크 피보팅을 돕기 위한 후-침투 도구입니다. unix 시스템에서 사용자 이름, SSH 키 및 알려진 호스트를 수집한 후 발견된 모든 조합에 대해 SSH로 연결을 시도합니다. punk.py는 표준 python2 및 python3 인터프리터 모두에서 작동하도록 작성되었습니다. 스크린샷 예제 표준 실행: root@kitploit: $ ./punk.py passwd 검사를 건너뛰고 사용자 지정 홈 경로 사용:...

Shellshock

Exploit de Shellshock CVE-2014-6271 Exploit Descripción Este repositorio contiene un exploit para una vulnerabilidad que afecta a sistemas basados en Unix. Ten en cuenta que esto es meramente un script de prueba de concepto creado con fines educativos y debe usarse de manera responsable. Este...

Narthex

Narthex Narthex 그리스어: Νάρθηξ, νάρθηκας는 C와 셸Shell로 작성된 유닉스 및 유닉스 계열 운영 체제용 모듈식 최소 사전 생성기입니다. 개인화된 사전을 생성하여 비밀번호 복구 및 보안 평가에 사용할 수 있는 독립적인 유닉스 스타일 프로그램들을 포함하고 있습니다. 이 프로그램들은 유닉스 철학에 따라 유닉스 텍스트 스트림을 사용하여 서로 협력합니다. GPL v3.0 라이선스로 배포됩니다. Narthex 사용법을 설명하는 동영상을 만들었습니다:...

GHSA-528H-PC64-C93X vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

CVE-2026-78897 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-76172 vulnerabilities

Vulnerabilities for packages: unleash-proxy, gitlab-rails-ce, gitlab-rails-ce-fips, kibana, keep, langfuse-fips, wazuh-dashboard-fips, tileserver-gl-fips, prism, vitess, keep-fips, unleash-fips, wazuh-dashboard, nextcloud-server, yaml-language-server, opensearch-dashboards-fips, unleash, langfuse...

CVE-2026-67315 vulnerabilities

Vulnerabilities for packages: nextcloud-server, jitsucom-jitsu, kubeflow-centraldashboard, prism, opensearch-dashboards, langfuse, lerna...

CVE-2026-27878 vulnerabilities

Vulnerabilities for packages: grafana, grafana-fips, commercial-grafana...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-59981

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

Astra Linux – Vulnerability in Samba

Windows Kerberos Elevation of Privilege Vulnerability...

CVE-2026-48750

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-48754

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-50190

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

CVE-2026-55564

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...