2845 matches found
velociraptor
Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...
SentinelOne-ATTACK-Queries
ATT&CK Mapped SentinelOne Queries MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity DISCONTINUED This project has been replaced by theSentinelOne-Queries repository which moves towards shareable signatures and for use in tooling. New repo is built of the work within this repository and...
AIOstack
AI agents always look authorized. AIOStack tells you when they're not. AI agents act on behalf of users. They use real credentials, make real API calls, invoke tools, access APIs, and touch production systems. Most security tools see this activity as legitimate because, technically, it is. The re...
Imperius
Imperius Make an LKM rootkit visible again. It involves getting the address of the "moduleshow" function from a rootkit, for example the diamorphine rootkit, and using it to call it, adding it back to lsmod, making it possible to remove an LKM rootkit. We can obtain the function address in very...
custom-bytecode-analyzer
custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...
trivy
📖 Documentation Trivy pronunciation is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets what Trivy can scan: Container Image Filesystem Git Repository remote Virtual Machine Image Kubernetes...
ModTracer
ModTracer v1.0 ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again. Another way to make an LKM visible is using the imperius trick: https://github.com/MatheuZSecurity/Imperius Join in Rootkit Researchers Group https://discord.gg/66N5ZQppU7...
DeTTECT
Detect Tactics, Techniques & Combat Threats Latest version: 2.2.0 To get started with DeTT&CT, check out one of these resources: This page on the Wiki. This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT. Blog:...
mcp-shark
mcp-shark Security scanner for AI agent tools — built for security and platform engineers working with MCP in the IDE. Run a local static scan over MCP IDE configs and embedded tool metadata: 41 rules including AAuth visibility, toxic-flow heuristics, and SARIF / HTML / JSON reports. There is no...
Malcolm
Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...
badBANANA-threat-observatory
badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...
KevinLAB BEMS (Building Energy Management System) - Backdoor Account
KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...
NetAlertX
NetAlertX - Network Visibility & Asset Intelligence Framework !mainmain 📷 Click for more screenshots !Main screenmain| !devicedetails 1devicedetails| !Screen networknetwork ---|---|--- !presencepresence| !maintenancemaintenance| !settingssettings !synchubsynchub| !report1report1|...
CVE-2026-129455
The Zr.Admin.NET project (commits e6ceaf4 through eb9228a ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the FrontArticleController component. This flaw allows authenticated users to manipulate the visibility and pin state of articles belonging to other users. Specific...
EUVD-2026-125957
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId...
cornershot
What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote host’s network access without the need to have any special privileges on that host...
PT-2026-147446
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId...
CVE-2026-129455: izhaorui Zr.Admin.NET: Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in…
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId...
sysflow
SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...