Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

PatchaPalooza now shows exploit & detection coverage for every CVE. - Exploit coverage (VulnCheck, GitHub PoC, Nuclei, Metasploit) - Detection coverage (Sigma, YARA from 40+ repos) 12,500+ Microsoft CVEs enriched. All free, all open. Example:

18,452 görüntüleme • 6 ay önce •via X (Twitter)

0 Yorum

Yorum bulunmuyor

Orijinal gönderinin yorumları burada görünecek

Benzer Videolar

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

chiefofautism

70,129 görüntüleme • 6 ay önce

🚨 POC for CVE-2025-55182 that works on Next.js 16.0.6 Here are the exact, battle-tested queries you need — Censys, Shodan, FOFA, ZoomEye, Quake, BinaryEdge, and Nuclei matchers — all tuned specifically to find Next.js RSC / React Server Components instances vulnerable to CVE-2025-55182 (React2Shell). ⸻ ✅ 1. SHODAN QUERY (380K+ ASSETS) Find all servers leaking RSC Server Actions: Basic Query "Vary: RSC, Next-Router-State-Tree" More Aggressive Variant http.headers.vary:"RSC" AND http.headers.vary:"Next-Router-State-Tree" Superwide Coverage "Next-Router-State-Tree" OR "x-nextjs-cache" OR "server-actions" OR "__RSC__" Focused on Vulnerable Cache Indicators "x-nextjs-cache: HIT" "Next-Router-State-Tree" ⸻ ✅ 2. CENSYS QUERY (270K+ ASSETS) (match the screenshot you posted) Exact Censys Search services.http.response.headers.vary: "RSC, Next-Router-State-Tree" Safer Multi-Matcher services.http.response.headers.vary: "RSC" AND services.http.response.headers.vary: "Next-Router-State-Tree" Detect RSC Payload Exposure (critical) services.http.response.body: "__RSC__" Detect Flight Data Leaks services.http.response.body: "server-reference-manifest" ⸻ ✅ 3. FOFA QUERY (CHINA’S OSINT GIANT) (VERY POWERFUL for RSC/Next.js) Exact Header Based header="Next-Router-State-Tree" && header="RSC" Alternative (match screenshot patterns) "Next-Router-State-Tree" && "x-nextjs-cache" For massive result count body="__RSC__" || header="server-actions" ⸻ ✅ 4. ZOOMEYE QUERY ZoomEye scans often catch Node.js apps Shodan misses. Exact Unicode-Ready Query "Next-Router-State-Tree" && "RSC" Advanced app:"Next.js" && header:"RSC" ⸻ ✅ 5. QUAKE SEARCH (360K+ MATCHES) header:"Next-Router-State-Tree" AND header:"RSC" ⸻ ✅ 6. BINARYEDGE QUERY http.response.headers.vary:"Next-Router-State-Tree" ⸻ ✅ 7. QUERY headers:"Next-Router-State-Tree" && headers:"RSC" ⸻ 🎯 8. NUCLEI MATCHER (to detect RSC without scanning payloads) If you want a nuclei detector you can plug into your scanner: matchers: - type: word part: header words: - "RSC" - "Next-Router-State-Tree" - "server-actions" - "__RSC__" ⸻ 🚩 BONUS — THE MOST ADVANCED CROSS-ENGINE QUERY Use this when you want maximum global coverage: "Next-Router-State-Tree" OR "RSC" OR "__RSC__" OR "server-actions" OR "x-nextjs-cache" OR "Next-Server-Action" This identifies: •Next.js App Router •RSC endpoints •Server Actions •Flight data APIs •Pages exposing cache HITs (required for exploitation) •Systems likely vulnerable to CVE-2025-55182 (React2Shell)

X

10,544 görüntüleme • 9 ay önce

9 repos that mass replace a $150,000/year NBA analytics department. all free. all open source. -> replaces Second Spectrum and SportVU YOLO tracks every player and ball from any broadcast. assigns teams by jersey color. court keypoint detection builds a tactical top-down map. speed, distance, passes - all from a TV feed. no sensors. -> replaces paid NBA prediction services ($100/mo) XGBoost + Neural Net. moneyline and totals. Kelly Criterion sizing. 69% accuracy. pulls odds from FanDuel/DraftKings automatically. the most starred NBA betting repo on GitHub. -> replaces an entire quant sports desk 5-model ensemble: XGBoost + PyTorch MLP + Ridge + Lasso + baseline. Optuna-tuned hyperparameters. SQLite database with box scores, play-by-play, betting lines, injury reports. production-grade. -> replaces manual daily prediction workflows XGBoost/LightGBM with GitHub Actions automation. scrapes new data, retrains models, outputs daily win probabilities. set it and forget it. -> replaces ELO subscription services custom ELO + Ridge + XGBoost + Neural Networks ensemble. full data scraping pipeline. comprehensive visualizations. FiveThirtyEight-style ratings from scratch. -> replaces Four Factors analytics dashboards ELO rating system + Four Factors + PCA dimensionality reduction. detailed comparison of 10+ models. honest 65.3% accuracy - because that's what real NBA prediction looks like. -> replaces computer vision analytics platforms ($500/mo) YOLO player/ball tracking. automatic team assignment. court keypoints. pass and interception detection. speed and distance. full tactical view. modular architecture. -> replaces shot tracking hardware YOLOv8 detects ball and hoop in real-time. linear regression predicts trajectory. registers makes and misses automatically. works on any video feed. -> replaces paid sports data subscriptions ($300/mo) official Python client for NBA. com API. box scores, play-by-play, shot charts, player tracking. 40+ years of data. zero cost. the foundation every NBA ML project is built on. like + bookmark you'll need this when you build your first NBA prediction bot

zostaff

103,649 görüntüleme • 4 ay önce

HERMES AGENT NOW HAS AUTOMATION TEMPLATES. COPY-PASTE RECIPES FOR CRON JOBS AND WEBHOOKS. ANY MODEL. ANY DELIVERY PLATFORM. three trigger types: SCHEDULE → runs on a cadence (hourly, nightly, weekly) GITHUB EVENT → fires on PR opens, pushes, issues, CI results API CALL → any external service POSTs JSON to your endpoint all three deliver to Telegram, Discord, Slack, SMS, email, GitHub comments, or local files.Nous Research what templates ship right now: DEVELOPMENT: → nightly backlog triage (label + prioritize new issues) → automatic PR code review (posts review on every PR) → docs drift detection (finds code changes without doc updates) → dependency security audit (daily CVE scan, CVSS >= 7.0) DEVOPS: → deploy verification (smoke tests after every deploy) → alert triage (correlates alerts with recent changes) → uptime monitor (check endpoints every 30 min, notify only when something is down) RESEARCH: → competitive repo scout (monitor competitor PRs daily) → weekly AI news digest (headlines, papers, repos, industry) → daily arXiv scan (saves summaries to your notes) the webhook system is the part most people miss: hermes webhook subscribe github-pr-review \ --events "pull_request" \ --prompt "Review this PR for security, performance, and code quality." \ --skills "github-code-review" \ --deliver github_comment one command. every future PR gets reviewed automatically. the review posts as a comment directly on the PR. two cost-saving details from the docs: 1. use [SILENT] in prompts. "if nothing changed, respond with [SILENT]" prevents notification noise on monitoring jobs. 2. use script-only cron jobs for data collection. a Python script handles HTTP requests and file reads. the agent only sees stdout and applies reasoning. cheaper and more reliable than having the agent fetch. every template is copy-paste ready. every template works with any model. docs: full Hermes agent SOUL MD guide in the article 👇

YanXbt

38,087 görüntüleme • 2 ay önce