xc

XC Netcat like reverse shell for Linux & Windows. Features Windows Usage: └ Shared Commands: !exit !upload uploads a file to the target !download downloads a file from the target !lfwd local portforwarding like ssh -L !rfwd remote portforwarding like ssh -R !lsfwd lists active forwards !rmfwd...

SSRFire

SSRFIRE An automated SSRF finder. Just give the domain name and your server and chill! ; It also has options to find XSS and open redirects. Syntax ./ssrfire.sh -d domain.com -s yourserver.com -f customfile.txt -c cookies domain.com --- The domain for which you want to test yourserver.com ---...

GhostTrack

GhostTrack Useful tool to track location or mobile number, so this tool can be called osint or also information gathering New update : Version 2.2 Instalation on Linux deb sudo apt-get install git sudo apt-get install python3 Instalation on Termux pkg install git pkg install python3 Usage Tool gi...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

CVE-2022-23614

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v Twig sort filter code execution/sandbox bypass As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort here, thus leading to arbitrary code executi...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Local server broken access control. Timeline Vulnerability reported to vendor: 22.09.2023 New fixed 1.1.9.4 version released: 08.12.2023 Public disclosure: 15.12.2023 Description IBM i Access Client Solutions for storing temporary password...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can...

asf__nifi_CVE-2023-34468_1-21-00

nifi Apache NiFi는 데이터를 처리하고 배포하기 위한 사용하기 쉽고, 강력하며, 안정적인 시스템입니다. 목차 기능 요구 사항 시작하기 MiNiFi 하위 프로젝트 Registry 하위 프로젝트 도움말 문서 라이선스 수출 통제 기능 Apache NiFi는 데이터플로우를 위해 만들어졌습니다. 데이터 라우팅, 변환 및 시스템 중재 로직의 고도로 구성 가능한 유향 그래프를 지원합니다. 주요 기능 중 일부는 다음과 같습니다: 웹 기반 사용자 인터페이스 설계, 제어 및 모니터링을 위한 원활한 경험 다중 테넌트 사용자 경험 고도로...

retryabledns

Retryable dns resolver Based on miekg/dns and freely inspired by bogdanovich/dnsresolver. Features Supports both system default DNS resolvers and user-provided ones Retries DNS requests in case of I/O errors, timeouts, or network failures Allows arbitrary query types Resolution with random...

Burp-Suite-Certified-Practitioner-Exam-Study

Burp Suite Certified Practitioner 試験対策 これは、110以上のPortSwigger Academyラボを使用した私の学習ノートです。 これらのラボを使用して、2023年のBurp Suite Certified Practitioner試験に合格しました。 私のBSCP認定資格。 最新の学習教材については、PortSwigger Academyをご覧ください。 スキャニング - 列挙 フォーカススキャン 非標準エンティティのスキャン 足場 - ステージ1 コンテンツ発見 DOM-XSS XSS クロスサイトスクリプティング...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

pwnflow

Pwnflow 🎯 Visualize Your Security Testing & Analysis Journey Pwnflow is a mind-mapping platform designed specifically for cybersecurity professionals. it helps you visualize, track, and share your security testing methodologies while maintaining complete control over your sensitive data. 🚀 Key...

pig

Pig Pig Packet intruder generator로 이해될 수 있습니다는 Linux 패킷 제작 도구입니다. Pig를 사용하여 IDS/IPS 등 다른 것들을 테스트할 수 있습니다. Pig는 즉시 사용 가능한 잘 알려진 공격 시그니처 모음을 제공하며, 필요에 따라 이 컬렉션을 더 구체적인 항목으로 확장할 수 있습니다. 현재까지는 TCP, UDP, ICMP 기반의 전송 계층을 가진 IPv4 시그니처를 만들 수 있습니다. 또한 ARP 프로토콜 기반의 시그니처를 만들 수 있으며, Ethernet 프레임부터 패킷을 구성할 수도...

medusa

🐍 MEDUSA - AI セキュリティスキャナ AI/ML、エージェント、LLM アプリケーション向けの 40,000 以上の検出パターンを備えた AI ファーストのセキュリティスキャナ。 🤖 インストールするだけで即動作 - 外部ツールのインストールは不要。 🚨 200 件の CVE: Log4Shell、Spring4Shell、XZ Utils、LangChain RCE、MCP-Remote RCE、React2Shell 🔥medusa scan --git — あらゆるリポジトリを AI サプライチェーン攻撃 リポジトリポイズニング、プロンプトインジェクション、MCP...

Microsoft Bookings Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

reaver-wps-fork-t6x

개요 Reaver 는 WPA/WPA2 비밀번호 를 복구하기 위해 Wifi Protected Setup WPS 레지스트라 PIN 에 대한 무차별 대입 공격 을 구현한 도구로, Stefan Viehböck 의 Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. 문서에 설명되어 있습니다. Reaver 는 Wi-Fi Protected Setup WPS 레지스트라 PIN에 대한 견고하고 실용적인 공격을 수행하도록 설계되었으며, WPA/WPA2...

xerosploit

Xerosploit Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for testing purposes. It brings various modules that allow to realise efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by bettercap and nma...

Log4j2-CVE-2021-44228

CVE-2021-44228 Remote Code Injection In Log4j https://twitter.com/jas502n/status/1468946197629272066 SpringBoot-pom.xml default use : xml org.springframework.boot spring-boot-starter-web mvn dependency:treejava INFO | | +- org.springframework.boot:spring-boot-starter-logging:jar:2.6.1:compile INF...

mal_unpack

malunpack PE-sieve をベースにした動的アンパッカー 📖 詳細はこちら . パックされたマルウェアを展開し、ペイロードがアンパックされるのを待って、ペイロードをダンプし、元のプロセスを終了させます。 !CAUTION このアンパッカーは元のマルウェアを実行します。仮想マシン上でのみ使用してください。 ⚙ 使い方 基本的な使い方： malunpack.exe /exe /timeout デフォルトでは、埋め込まれたPEをダンプします。 シェルコードをダンプしたい場合は、オプション /shellc を使用してください。...