p-invoke.net

p-invoke.net This repository contains most of the P/Invoke definitions from the most-of-the-time offline pinvoke.net, adding the link to the Microsoft documentation for each one. The Gitbook is available at https://ricardojoserf.gitbook.io/pinvoke. Notes I did this to check some definitions in a...

p-gen

ABOUT TOOL : P-gen tool is an python based script which create/generate randrom passwords in fraction of seconds. This tool works on both rooted Android device and Non-rooted Android device. AVAILABLE ON : Termux TESTED ON : Termux REQUIREMENTS : internet storage 200 MB FEATURES : + Stable tool !...

Get-PDInvokeImports

Get-PDInvokeImports Description: Get-PDInvokeImports is tool PowerShell module which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke usage in assembly. Showing all locations from where they are referenced and Exports all to DnSpyBookmarks.xml This PS module could...

EvilClippy

This tool was released during our BlackHat Asia talk March 28, 2019. A video recording of this talk is available at https://www.youtube.com/watch?v=9ULzZA70Dzg. Evil Clippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

koppeling-p

koppeling-p Adaptive DLL hijacking / dynamic export forwarding - EAT preserve Overview This project is a limited, Python-only extension to the amazing project by Nick Landers @monoxgas, available here. Differences The only difference to the original project is that koppeling-p p stands for...

ghostrings

Ghostrings Scripts for recovering string definitions in Go binaries with P-Code analysis. Tested with x86, x86-64, ARM, and ARM64. Scripts Golang These can be found in the Golang category in the Script Manager. GoDynamicStrings.java Analyzes P-Code to find string structures created on the stack...

CVE-2021-25461

CVE-2021-25461 This is a repo with the Proof of Concept for the CVE discovered for the SAUSAGE Security Analysis of Unix domain Socket usAGE in Android paper that was accepted to EuroS&P 2022. I worked on this paper with Mounir Elgharabawy, the one who discovered the vuln and wrote the Proof of...

CVE-2026-120241: Ruijie: A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P…

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW1.01B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to...

SuperGhidra

SuperGhidra SuperGhidra: Compilable C Rewriter & Guardrailed Agent MCP Suite. Python tools that make Ghidra faster to script against, rewrite raw decompiler output into compilable C, and run static binary analyses Ghidra does not include out of the box: MSVC RTTI and MFC CRuntimeClass recovery,...

cve-2024-13176-timing-analysis

Instrumented Detection of Low-Amplitude ECDSA Timing Leakage in CVE-2024-13176 This repository contains the research report, website, data, source material, and reproducibility files for an independent study of CVE-2024-13176. The project looks at whether the nonce-related timing condition report...

cakephp-cookie-suffix

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-cookie-suffix Write-up: https://abraxaslabs.tech/research/cakephp-cookie-suffix cakephp-cookie-suffix Class: Cookie leak / plant Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation...

zyxel-p870hn-hardware-hacking

From a bare PCB to root: hardware-hacking a ZyXEL P-870HN over UART Two phone photos of an unlabeled router board → serial console → auth bypass → root shell — reproducing the real, still-unpatched chain CVE-2025-0890 hidden supervisor account + CVE-2024-40891 CLI command injection on hardware I...

CVE-2026-115795

P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In...

CVE-2026-112200

P-Net before 1.0.3 does not release the Application Relationship AR and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted t...

CVE-2026-115794

P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application...

CVE-2026-115793

P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answer...

CVE-2026-111735

P-Net before 1.0.3 contains an integer underflow in pfcpmcdataind. When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long...

CVE-2026-111734

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end...

CVE-2026-111733

P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot. A remote unauthenticated attacker can send...