Browser-Pwning-

Browser-Pwning 一份条理清晰、结构完善的文档，帮助你入门 chrome 漏洞利用 & v8 漏洞利用 文档结构 本文档的组织方式 1. 动机 2. 实际学习材料 动机 浏览器是当今最常用的技术之一。在每一台现成的计算机上，只要我们即插即用，就会看到已安装的浏览器。因此，从攻击者和威胁模型的角度来看，如果攻击者能够通过恶意页面攻破浏览器，那将是非常有回报的。基于上述理由，我选择研究 Google 的 JavaScript 引擎，尤其是 v8。 鉴于 v8 项目规模庞大，我选择以解释器（即 d8）作为起点。尽管针对 d8 已经进行了大量研究，但我们仍希望至少能找到一个...

beef

Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com 请参阅文件 'doc/COPYING' 以获取复制许可 =============================================================================== 什么是 BeEF？ BeEF 是 浏览器利用框架（The Browser Exploitation Framework）...

JShell

JShell JShell - XSS で JavaScript シェルを取得。 使用方法 shell.py を実行します。 すると JShell が自動的にあなたの IP アドレスを検出しようとします。デフォルトの LPORT は 33 です。 ペイロードが生成されたのがわかります。あとはこのペイロードを被害者に送信するだけです。 そうすると、netcat 経由で JS シェルが取得でき、注入されたページが開かれるとすぐに被害者のブラウザで JavaScript コードを実行できます。 スクリーンショット: クレジット、免責事項、ライセンス このスクリプトは Rodolfo Assis...

beef

=============================================================================== root@kitploit: Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com See the file 'doc/COPYING' for copying permission...

CVE-2018-5146

CVE-2018-5146 exp y poc poc.ogg : archivo poc construido por uno mismo cve-test2.html : archivo exploit crctest.exe: calcula el CRC32 del archivo ogg...

browser-pwn

Browser-Pwn === 浏览器世界由四大主要参与者主导： Chromium/Chrome（Blink 引擎） Firefox（Gecko 引擎） Safari（WebKit 引擎） Edge（Blink 引擎，前身为 EdgeHTML 引擎） 以下内容分为两个部分： 帮助理解其架构与实现，以及如何从源码构建它们的信息 帮助找到让它们弹出计算器（calculator popping）的功能的信息 目录 1. 引擎 概述 Chromium Firefox Safari Edge 2. 漏洞利用 概述 Chromium Firefox Safari Edge 3. 工具 4...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

ServiceNow CVE-2025-11449 & CVE-2025-11450 Mitigation Script Overview This script automatically detects and remediates CVE-2025-11449 and CVE-2025-11450 security vulnerabilities in ServiceNow UI Macros. These vulnerabilities could allow arbitrary code execution in users' browsers through speciall...

CVE-2019-0567-MS-Edge

CVE-2019-0567-MS-Edge POC 一个针对 MS Edge 的概念验证，作为学习浏览器利用和 Windows 10 机器上迁移的练习。所有代码均由 Connor McGarr 创建，并经过修改以适用于 Windows 10 Build 15063.483。 shell2js.py 我个人的脚本，用于将 msfvenom C 载荷转换为 JavaScript 载荷格式。 概念验证视频 Connor McGarr 博客： https://connormcgarr.github.io/type-confusion-part-3/...

CVE-2026-81092

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81099

Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-76252 Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...

Hacking Safari with GPT 5.4

When Anthropic unveiled Mythos and Project Glasswing, the reaction was immediate and polarized. Some dismissed it as fear-driven marketing, while others treated it as a credible shift in the threat landscape. Like with many things, the truth is probably somewhere in the middle. I wanted to test...

Smoothwall Express Cross-Site Scripting Vulnerability (CNVD-2026-14349)

Smoothwall Express is Smoothwall open source a GNU/Linux-based firewall operating system . Smoothwall Express cross-site scripting vulnerability , the vulnerability stems from the portfw.cgi script multiple parameters of the user-supplied data lack of effective filtering and escaping , an attacke...

Esri ArcGIS Server 跨站脚本漏洞

Esri ArcGIS Server is a web-oriented enterprise software platform available for providing geolocation services from Esri. A cross-site scripting vulnerability exists in Esri ArcGIS Server version 11.4 and earlier, which stems from a stored cross-site scripting issue that could lead to malicious...

CVE-2025-34399

MailEnable versions prior to 10.54 are affected by a reflected XSS in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized for GET requests and is echoed inside a [removed] block in the JavaScript variable sAddrCc, enabling an attack...

Docker MCP Gateway 安全漏洞

Docker MCP Gateway is a gateway service from Docker Inc. in the United States. A security vulnerability exists in Docker MCP Gateway version 0.27.0 and earlier, which stems from vulnerability to DNS rebinding attacks when running in sse or streaming transport mode, and could lead to browser-based...

EUVD-2025-34748

Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-10552

The CVE-2025-10552 entry describes a stored Cross‑site Scripting (XSS) vulnerability in 3DSwym on the 3DEXPERIENCE platform (R2025x). The vulnerability affects 3DSwym prior to Release R2025x and allows an attacker to execute arbitrary script in a user’s browser session. The PT-2025-41765 advisory...