Aggregator

Connecting to home WiFi on a jugg device

不安全
10 months 2 weeks ago
r/HowToHack 是一个开放的黑客社区，旨在帮助新手成长为资深人士。用户可以在此提问、解答和学习地下技能，并通过 Discord 进行交流。

BrainDamage – Payload Generator and Encrypted Shell Stager for Red Teams

不安全
10 months 2 weeks ago
BrainDamage 是一款用于红队和对手模拟团队的有效载荷生成与加密分阶段工具，支持 Linux、macOS 和 Windows。其功能包括 AES 加密、多种载荷类型（如 bash 反向壳、Python 载荷）、内置 HTTP/S 服务器以及会话跟踪等，适用于隐蔽载荷投递与早期阶段的攻击操作。

CVE-2024-26995 | Linux Kernel up to 6.8.7/6.9-rc4 tcpm pd_set off-by-one (f3da3192cdd3/c4128304c216 / WID-SEC-2024-1008)

Vuldb Updates
10 months 2 weeks ago
A vulnerability was found in Linux Kernel up to 6.8.7/6.9-rc4. It has been declared as problematic. Affected by this vulnerability is the function pd_set of the component tcpm. The manipulation leads to off-by-one. This vulnerability is known as CVE-2024-26995. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

jsubfinder: earch webpages & javascript for hidden subdomains and secrets in the given URL

Penetration Testing Tools - Metepreter.org
10 months 2 weeks ago

JSubFinder JSubFinder is a tool written in golang to search webpages & javascript for hidden subdomains and secrets in the given URL. Developed with BugBounty hunters in mind JSubFinder takes advantage of Go’s amazing...

The post jsubfinder: earch webpages & javascript for hidden subdomains and secrets in the given URL appeared first on Penetration Testing Tools.

ddos

[webapps] LPAR2RRD 8.04 - Remote Code Execution (RCE)

不安全
10 months 2 weeks ago
该漏洞利用LPAR2RRD 8.04中的远程代码执行和目录遍历漏洞（CVE-2025-54769），通过上传恶意Perl脚本至升级端点并利用目录遍历将其放置在CGI路径下，最终触发远程命令执行，实现对目标系统的控制。

[webapps] Gandia Integra Total 4.4.2236.1 - SQL Injection

不安全
10 months 2 weeks ago
该文章描述了一个SQL注入漏洞（CVE-2025-41373），影响路径`/encuestas/integraweb_v4/integra/html/view/hislistadoacciones.php?idestudio=`及其相关版本。攻击者可通过直接拼接`idestudio`参数注入任意SQL代码，并使用布尔和时间盲注技术进行检测。

Managed ad