singularity

Singularity of Origin Actualizaciones recientes: NUEVO 2025-11-25 : Chrome lanzó la versión 142 con Local Network Access LNA, que impide las técnicas de ataque de DNS rebinding implementadas en Singularity. La rama LNA-from-Non-Secure-Contexts de Singularity of Origin implementa soporte para Tria...

burpsuite-copy-as-xmlhttprequest

Extensión Copy as XMLHttpRequest para BurpSuite La extensión añade un menú contextual a BurpSuite que permite copiar múltiples solicitudes como XmlHttpRequest de Javascript, lo que simplifica el desarrollo de PoC al explotar XSS. Instalación descarga el último JAR desde releases o constrúyelo...

CVE-2022-0185-Analysis-and-Exploit

CVE-2022-0185-Analysis-and-Exploit Research and proof-of-concept for CVE-2022-0185 Linux kernel heap overflow vulnerability. CVE-2022-0185 – Linux Kernel Heap Overflow Analysis Overview CVE-2022-0185 is a heap-based buffer overflow vulnerability in the Linux kernel’s filesystem context...

chub-supply-chain-poc

Context Hub Supply Chain PoC Zero-sanitization vulnerability inContext Hub @aisuite/chub v0.1.3 enables silent dependency injection through the MCP documentation pipeline. References: CWE-94 Code Injection | CWE-829 Untrusted Control Sphere | CWE-345 Insufficient Verification of Data Authenticity...

macstealer

MacStealer: Bypass dell'isolamento client Wi-Fi 1. Introduzione Questo repository contiene MacStealer. Può testare le reti Wi-Fi per bypass dell'isolamento client CVE-2022-47522. Il nostro attacco può intercettare rubare il traffico verso altri client a livello MAC, anche se ai client è impedito...

opa

Open Policy Agent Open Policy Agent OPA è un motore di policy open source e di uso generale che consente un'applicazione delle policy unificata e sensibile al contesto nell'intero stack. OPA è orgoglioso di essere un progetto graduated nel panorama della Cloud Native Computing Foundation CNCF. Pe...

snuck

snuck Bypass automático de filtros XSS Resumen snuck es una herramienta automática cuyo objetivo es probar significativamente un filtro XSS dado, especializando las inyecciones en función del contexto de reflexión. Este enfoque utiliza Selenium para controlar un navegador web reproduciendo tanto ...

dwn

🥽 dwn dockerpwn - un gestor de herramientas de ataque para Docker introducción dwn es un "docker-compose para hackers". Utilizando un formato de "plan" YAML simple similar a docker-compose, se definen nombres de imágenes, versiones y asignaciones de volúmenes/puertos para configurar una herramien...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

reflector

reflector Descripción La extensión de Burp Suite es capaz de encontrar XSS reflejado en la página en tiempo real mientras se navega por el sitio web e incluye algunas características como: Resaltado de la reflexión en la pestaña de respuesta. Prueba de qué símbolos están permitidos en esta...

cve-2024-38077-madlicense_reproduction

CVE-2024-38077: Windows Remote Desktop Licensing Service Remote Code Execution "MadLicense" I. Vulnerability Overview CVE ID : CVE-2024-38077 Alias : MadLicense CVSS Score : 9.8 Critical Type : Heap-Based Buffer Overflow CWE-122 Discovered by : Ver, Lewis Lee, Zhiniang Peng Description : A...

ida-pro-mcp

IDA Pro MCP !IMPORTANT Consiglio invece di usare l'Official Hex-Rays IDA MCP Server! Consulta il post di annuncio sul blog per maggiori informazioni. Semplice MCP Server per consentire il vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 I...

inspector

MCP Inspector A developer tool for inspecting Model Context Protocol MCP servers. It ships as a single package, @modelcontextprotocol/inspector, that provides four ways to inspect a server: Web — a Vite + React + Mantine single-page app with a Node backend. CLI — a scriptable command-line client...

security-operations-labs

Security Operations Labs Overview This repository consolidates defensive security work from a university context in a form reworked for public traceability. The focus is on methodology, reproducible labs, validation, and the limitations of the measures developed—not on publishing course material...

vulnerable-mcp-servers-lab

Laboratorio di server MCP vulnerabili Questo repository contiene implementazioni volutamente vulnerabili di server Model Context Protocol MCP sia locali che remoti. Ogni server risiede nella propria cartella e include un README.md dedicato con tutti i dettagli su cosa fa , come eseguirlo e come...

Malicious Package

Overview @tvg-mar/promos-context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Updated flatpak package fixes security vulnerabilities

Arbitrary file deletion in root context via path traversal in deploy directory export/bin. CVE-2026-97023 Arbitrary write in root context via path traversal in deploy directory files/etc. CVE-2026-97024 World-readable oci authentication token in system-helper cache path. CVE-2026-97025...

CVE-2026-107282

A flaw was found in AsyncHttpClient. When an application performs request retries or failovers to a different host, the client fails to properly reset the original host's security and proxy context. Consequently, an unintended destination host can receive sensitive information, including...

EUVD-2026-95897

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a...

Malware in @tvg-mar/promos-context

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...