owt

Currently unstable will be updated eventually. Offensive Wifi Toolkit owt created by Brennan Mccown clu3bot This tool compiles some necessary tools for wifi auditing in a unix bash script with a user friendly interface. The goal of owt is to have the smallest file size possible while still...

CVE-2026-35191

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service DoS attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to...

CVE-2026-35191

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – Amplificación del handshake QUIC mediante la omisión de la validación de dirección Código del programa simulación en Python quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello"...

EUVD-2026-89002

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

CVE-2026-35191

The OpenSSL QUIC server is vulnerable to a violation of the RFC 9000 unvalidated connection amplification limit when address validation is disabled. The root cause is that the QUIC stack incorrectly adds the length of an entire datagram to the unvalidated credit limit for every individual QUIC pa...

callstranger-detector

Paquete Zeek que detecta intentos de CallStranger CVE-2020-12695 http://callstranger.com/ Este paquete intenta detectar intentos de explotación y exfiltración de datos de CallStranger CVE-2020-12695. Lo hace buscando tres elementos clave: 1. Comandos UPnP SUBSCRIBE con una URL de Notify que...

dns_amplification_scanner

DNS Amplification DDoS Detection and Verification Tool This script is designed to identify and verify potential DNS servers vulnerable to exploitation in DNS amplification distributed denial-of-service DDoS attacks. It addresses the limitations of automated vulnerability scanners like Nessus, whi...

ipeeyoupeewepee

ipeeyoupeewepee 一个针对公网主机（主要是 Cisco 路由器）的扫描与攻击套件，这些主机转发未经认证的 IP-in-IP 和 GRE 协议封装的数据包。 此漏洞被称为“隧道协议的不安全实现”，编号为 CVE-2020-10136 和 CVE-2024-7595。它允许你从受影响的主机发送（但不能接收）任意 IP 数据包。 乍看之下，只能发送不能接收数据包似乎毫无用处。然而，许多受影响的主机位于未实施反向路径过滤的网络中。这意味着你可以利用这些漏洞，在没有缺乏源地址验证（通常称为 IP 头部修改或 IPHM）的主机的情况下，在公网上伪造 IP 地址，从而发起 DNS...

ntpscanner

ntpscanner Escanea servidores NTP en busca de la vulnerabilidad de amplificación DDoS NTP CVE-2013-5211...

http2-bomb

Bomba HTTP/2 — CVE-2026-49975 PoC de Amplificación de Streams HTTP/2 · Docker · Consola Web Vulnerabilidad HTTP/2 permite multiplexar múltiples streams sobre una única conexión TCP. Este PoC construye tramas HEADERS especialmente formadas que contienen un gran número de referencias internas,...

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

QUIC Unvalidated Amplification Credit may be Over Accounted

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

CVE-2026-30784-rustdesk-poc

CVE-2026-30784-rustdesk-poc CVE-2026-30784: PoC de amplificación de tráfico de RustDesk hbbs y análisis de PCAP Hallazgos clave Hallazgo clave: Forzar la autenticación basada en claves -k no previene este ataque de amplificación, porque la respuesta de amplificación se activa durante la fase...

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-101917

A flaw was found in PyJWT. A remote attacker can trigger a Denial of Service DoS through outbound request amplification by submitting tokens containing unknown key identifiers. Because the library does not cache lookup failures or enforce a minimum refresh interval when fetching signing keys, eac...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 A denial-of-service DoS proof of concept targeting HTTP/2 servers. By combining HPACK amplification with stream retention, a single machine with a modest network connection can render a vulnerable server unavailable within seconds. Vulnerability CVE: CVE-2026-49975...

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

EUVD-2026-88478

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-101917 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...