Vulnerabilities

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page.

RansomLook created its Flask session-signing key without explicitly restricting the file permissions.

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust a…

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view.

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint.

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses.

RansomLook contains insufficient resource validation in the analysis PDF generation functionality.

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts.

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels.

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns.

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private.

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private.

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint.

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims.