crackerjack

!CAUTION 此仓库不再维护，请访问 https://github.com/sadreck/crackerjack 获取最新版本。 CrackerJack 由 Context Information Security 开发的 Hashcat 网页界面 目录 介绍 架构 功能特点 局限性 安装 故障排除 截图 许可证 介绍 CrackerJack 是一个用 Python 开发的 Hashcat 网页图形界面。 架构 本项目旨在保持 GUI 与 Hashcat 独立。简要来说，工作原理如下： 用户上传哈希值，选择字典/规则/掩码等，然后点击“开始”。 Web 服务器生成一个新的 scre...

mquery

mquery: 针对恶意软件分析人员的超快Yara查询工具 是否曾为搜索恶意软件样本而烦恼？Mquery 是一个对分析人员友好的 Web GUI，可用于检索你的数字仓库。 它能在眨眼间搜索数 TB 的恶意软件： 底层我们使用了 UrsaDB，通过 ngram 加速 yara 查询。 演示 公共实例即将上线，敬请期待…… 快速入门 1. 安装并启动 最简单的方式是使用 docker compose： git clone https://github.com/CERT-Polska/mquery.git cd mquery vim .env 可选 - 修改样本和索引目录位置 docker...

OpenShell

OpenShell OpenShell 是一个轻量级的开源反向 Shell 管理服务器，使用 Go 编写。 它允许用户建立反向 Shell 通道，并通过一个简单的基于 Web 的图形用户界面（GUI）进行交互。 如果您遇到 Bug 或有建议，请随时提交 Issue。 如果您觉得这个项目有用或有趣，请在仓库中点亮一颗 ⭐，非常感谢！您的支持将是我不断改进这个工具的巨大动力。 免责声明 本项目是出于我个人对网络安全学习的兴趣而开发的。然而，它可能被滥用于恶意目的。 请不要将本工具用于任何非法活动。 作者不对本软件的任何滥用行为负责。 背景 这个项目的想法源于我学习 Web...

dns-rebinding-tool

受 @tavisio 启发 该项目旨在成为一个全能工具包，用于测试进一步的 DNS 重新绑定攻击，也是我对这类攻击的个人理解。它包含一个 Web 服务器和一个仅响应 A 查询的伪 DNS 服务器。 Web 服务器的根索引页面提供了一个简陋的 Web 界面，用于配置和运行攻击。参见 dnsrebindtool.43z.one。 一个用于托管 Web 服务器的基本 nginx 配置 server listen 80; servername dnsrebindtool.43z.one; location / proxypass http://localhost:5000; Web 服务器的...

aparoid

Aparoid Aparoid 是一个专为 Android 应用分析设计的框架。它提供了一套自动化工具，用于发现移动应用中的漏洞和其他风险。它基于 Flask 框架构建，提供 Web GUI 用于上传 APK 文件并浏览内容/结果。 当前版本提供以下功能： 使用 jadx 进行 APK 反编译 漏洞检测系统（可通过仪表板配置规则） 二进制文件风险分析 针对 React Native、Flutter、Xamarin 和 Cordova 等框架的自定义功能 Android Manifest 安全检查 对所有（已 root）的 Android 设备（物理、模拟和云端）进行动态分析 用于绕过...

AgentCyTE

CORE TopoGen Genera topologías de red CORE reproducibles a partir de archivos XML de escenarios mediante una GUI web completa o una interfaz de línea de comandos. Tabla de contenidos Aspectos destacados Capturas de pantalla Inicio rápido Requisitos previos Instalar dependencias Iniciar la interfa...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

CVE-2026-8173

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

CVE-2026-8173

The web GUI of Murrelektronik Xelity switches is affected by an information disclosure vulnerability. When an authenticated administrator uses the 'Copy learned MAC Addresses' function, MAC addresses from the device's MAC address table are logged. Due to improper generation of error messages , an...

CVE-2026-8173 Information Disclosure via 'Copy learned MAC Addresses' Function

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

CVE-2026-8173 Information Disclosure via 'Copy learned MAC Addresses' Function

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

EUVD-2026-64744

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

PT-2026-79832

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

CVE-2026-8173: Generation of Error Message Containing Sensitive Information

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

SUSE CVE-2026-15371

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-15371

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-15371

Velociraptor's web GUI URL column type accepts arbitrary schemes (e.g., javascript:), enabling stored XSS when a victim clicks a crafted link. Root cause is lack of scheme allow-listing. CVSS 8.1 (HIGH) requires high privileges and user click. Exploitation in the wild is not reported. Advisory: h...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-15371

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...