c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

Kitsune

Kitsune Kitsune es un Comando y Control polimórfico. Esta herramienta te permite obtener una versión gráfica de tus herramientas de hacking favoritas, como NetExec, Villain o Evil-WinRM entre otras. Además, trae muchas mejoras como reconexión automática, informes, historial y algunas funciones...

Villain

Villain Propósito Villain es un framework C2 de alto nivel Etapa 0/1 que puede manejar múltiples shells TCP reversas y basadas en HoaxShell, mejorar su funcionalidad con características adicionales comandos, utilidades y compartirlas entre servidores hermanos conectados instancias de Villain...

WordPress Ultimate Nofollow plugin <= 1.4.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Ultimate Nofollow plugin versions = 1.4.8. Solution Deactivate and delete. This plugin has been closed as of November 3, 2021 and is not available for download. This closure is temporary, pending a full...

WordPress Batch Cat plugin <= 0.3 - Arbitrary Categories Add/Set/Delete to Posts vulnerability

Arbitrary Categories Add/Set/Delete to Posts vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Batch Cat plugin versions = 0.3. Solution Deactivate and delete. This plugin has been closed as of September 24, 2021 and is not available for download. This closure is temporary, pending a...

Urban Dictionary: DOM XSS through ads

Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...

Firefox Enables DNS over HTTPS

This is good news: Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send...

Space Villain Voice Changer - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Space Villain Voice Changer published at the 'play' market has multiple vulnerabilities...