В этой статье мы представляем Repeater Strike - новое расширение Burp Suite на базе AI, предназначенное для автоматизации поиска IDOR и подобных уязвимостей

Disclaimer: This blog is not related or contain any information about the bug at Pwn2Own Berlin. This is a bug I discovered by accident, and it has already been resolved. I don’t even know which CVE it corresponds to or which version it was patched. It looks like someone found it and kept it for red teaming purposes. If you know any information about this bug, please feel free to leave a comment

uv tool install 'git+https://github.com/OleFredrik1/remoteKrbRelayx.git'

# или

pipx install 'git+https://github.com/OleFredrik1/remoteKrbRelayx.git'

Post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory

uv tool install 'git+https://github.com/garrettfoster13/sccmhunter.git'
# или
pipx install 'git+https://github.com/garrettfoster13/sccmhunter/'

Модули 1-2 - введение в MCP, ключевые концепции, настройка среды, запуск первых серверов и клиентов, а также базовые вопросы безопасности

Модуль 3 - подробное пошаговое руководство по созданию и интеграции рабочего MCP-сервера и клиента с поддержкой LLM, настройкой в Visual Studio Code, тестированием и развёртыванием

Модули 4-5 - SDK, отладка и тестирование, механизмы масштабирования, корпоративная интеграция, аутентификация, стратегии маршрутизации и расширенные вопросы безопасности

Модули 6-10 - реальные задачи внедрения, performance tuning, лучшие практики, примеры из практики и практический семинар по созданию сервера с AI Toolkit

#!/usr/bin/env python3

import asyncio
from mcp.server.fastmcp import FastMCP
from mcp.server.transports.stdio import serve_stdio

# Create a FastMCP server
mcp = FastMCP(
    name="Calculator MCP Server",
    version="1.0.0"
)

@mcp.tool()
def add(a: float, b: float) -> float:
    """Add two numbers together and return the result."""
    return a + b

@mcp.tool()
def subtract(a: float, b: float) -> float:
    """Subtract b from a and return the result."""
    return a - b

@mcp.tool()
def multiply(a: float, b: float) -> float:
    """Multiply two numbers together and return the result."""
    return a * b

@mcp.tool()
def divide(a: float, b: float) -> float:
    """
    Divide a by b and return the result.
    
    Raises:
        ValueError: If b is zero
    """
    if b == 0:
        raise ValueError("Cannot divide by zero")
    return a / b

if __name__ == "__main__":
    # Start the server with stdio transport
    asyncio.run(serve_stdio(mcp))

A comprehensive security scanner designed to identify SharePoint instances vulnerable
to CVE-2025-53770, which involves a deserialization vulnerability in SharePoint's
ExcelDataSet component that allows remote code execution and machine key extraction

This scanner incorporates real-world attack patterns observed in active exploitation
campaigns and provides detailed confidence scoring based on machine key extraction,
secondary payload deployment, and SharePoint component processing indicators

[
  {
    "host": "sharepoint.example.com",
    "url": "https://sharepoint.example.com/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx",
    "scan_time": "2025-07-21T10:30:00.123456",
    "vulnerable": true,
    "status_code": 200,
    "response_size": 15432,
    "error": null,
    "response_time": 1.23
  }
]

▪️SSH Keys
▪️Crontab
▪️Bashrc
▪️APT
▪️Privileged user & SUID bash
▪️Malicious Systemd
▪️Hunting LKM Rootkits
▪️LD_PRELOAD rootkit
▪️PAM Backdoor
▪️ACL
▪️init.d
▪️Motd
▪️Mount process for hide any pid
▪️Webshells
▪️rc.local

😉 Test your prompts and models with automated evaluations
😉 Secure your LLM apps with red teaming and vulnerability scanning
😉 Compare models side-by-side
😉 Automate checks in CI/CD
😉 Share results with your team