Web安全

CVE-2025-6389：WordPress 未授权RCE漏洞POC

https://github.com/B1ack4sh/Blackash-CVE-2025-6389

CVE-2025-58360：GeoServer WMS SLD XXE漏洞检测POC

https://gist.github.com//bolhasec/32fa035354d7cc9417aa297e2fe22b30

CloudRip：发现Cloudflare背后的真实IP地址

https://github.com/moscovium-mc/CloudRip

Web-Cache-Vulnerability-Scanner：基于Go的Web缓存投毒漏洞扫描工具

https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner

Web漏洞研究与逆向分析方法指南

https://projectdiscovery.io/blog/how-to-research-web-vulnerabilities

内网渗透

RelayInformer：Python和BOF工具，用于确定NTLM中继目标的EPA执行级别

https://github.com/zyn3rgy/RelayInformer

探讨Pass-The-Cert攻击在Entra ID设备间的横向移动技术

https://www.alteredsecurity.com/post/long-live-pass-the-cert-reviving-the-classical-rendition-of-lateral-movement-across-entra-id-joined

终端对抗

无害的Netcat模拟工具，用于检测测试

https://github.com/Neo23x0/NoCat

Conquest：Nim语言C2框架的加密通信

https://jakobfriedl.github.io/blog/nim-c2-traffic/