33 matches found
zeek-elf
Un paquete ELF de Zeek Este paquete implementa: ELF ¡En resumen! Si tienes zkg y ya has ejecutado... root@kitploit: zkg autoconfig ... entonces puedes instalar este paquete así: root@kitploit: sudo zkg install zeek-elf Ahora, en cualquier script de Zeek, solo carga el plugin y "simplemente...
community-id-spec
Community ID 流哈希 在处理来自各种监控应用（如 Zeek 和 Suricata）的流数据时，通常希望 能够快速地从一份数据集切换到另一份。虽然所需的流元组信息通常都存 在于数据集中，但这种“关联（join）”的细节可能十分繁琐，尤其是在 边界情况下。本规范描述了“Community ID”流哈希，它将表示给定网络 流的字符串标识符的生成过程标准化，从而把这种切换简化为简单的字符 串比较。 伪代码 root@kitploit: function communityidv1ipaddr saddr, ipaddr daddr, port sport, port dport, i...
zeek-spicy-ospf
zeek-spicy-ospf 这是一个基于 Spicy 的 Zeek OSPF v2 和 v3 数据包分析器。您必须安装 Spicy 才能使用此包。 链接： 原始逻辑经作者许可从 https://github.com/s-wells/spicyparsers/tree/main/ospf 导入。 https://datatracker.ietf.org/doc/html/rfc2328 https://datatracker.ietf.org/doc/html/rfc2740 https://datatracker.ietf.org/doc/html/rfc5340...
zeek-community-id
面向 Zeek 的 "Community ID" 流哈希 这个 Zeek 包提供对 Community ID 流哈希的支持，这是一种在网络监控器中标记流量流的标准化方式。加载该包后，它会在 conn.log 中添加一个 communityid 字符串字段。 注意 Zeek 6 及更高版本已包含 Community ID 支持。 使用这些 Zeek 版本时，您不再需要此包。 详情请参阅 相关文档。 该包实现了一个 BiF 来执行哈希逻辑，因此需要二进制编译，所以它同时也是一个 Zeek 插件。以下是一个生成的 conn.log 示例： root@kitploit: separator \x...
zeek-spicy-stun
STUN Session Traversal Utilities for NAT STUN This is a Zeek protocol analyzer that detects STUN based on Spicy. You must install Spicy to use this package. This package will create two logs: stun.log - This log has every STUN message. stunnat.log - This log has NAT detections from mapped...
zeek-plugin-roca
Johanna::ROCA 该插件实现了对 CVE-2017-15361 密钥的检测；它是 https://github.com/crocs-muni/roca 上源代码的重新实现。 该插件提供了两个新的 BIF，可用于检查公钥： rocavulnerablecert 检查证书是否存在漏洞 rocavulnerablemod 检查模数是否存在漏洞。 该插件还附带了一个自动加载的脚本，当在网络上遇到 CVE-2017-15361 密钥时，它可以通知你。 要启用此功能，请设置： root@kitploit: redef ROCA::Notify=T; 之后，当遇到此类密钥时，你应该会看到...
PT-2026-62010
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
PT-2026-62011
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
EUVD-2023-59424
Malicious code in bioql PyPI...
EUVD-2023-59423
Malicious code in bioql PyPI...
EUVD-2023-59425
Malicious code in bioql PyPI...
The vulnerability of the Zeek plugin for industrial system management protocols ICSNPP-Ethercat, which involves reading data beyond the buffer in memory, allows attackers to cause service failures or gain unauthorized access to protected information.
The vulnerability of the Zeek plugin for industrial system management protocols ICSNPP-Ethercat relates to the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or gain unauthorized access to protected information...
The vulnerability of the Zeek plugin for industrial control systems’ network protocols (ICSNPP-Ethercat) relates to writing beyond the buffer boundaries in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the Zeek plugin for industrial control systems’ network protocols ICSNPP-Ethercat is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Zeek plugin for industrial system control protocols (ICSNPP-Ethercat) relates to writing beyond the buffer boundaries in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the Zeek plugin for industrial control systems’ network protocols ICSNPP-Ethercat is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2023-7242
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...
CVE-2023-7243
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7243
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7244
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution...
Out-of-bounds
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...
CVE-2023-7242 Ethercat Zeek Plugin Out-of-bounds Read
Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...