witchcraft

🎉 당신의 OPSEC 동반자. witchcraft help 또는 witchcraft manual 전체 매뉴얼을 실행하세요 🎉 무엇을 하나요? WITCHCRAFT는 단순한 별칭 이상의 것입니다. busybox, 셸, 그리고 해킹, OSINT, 포렌식 등을 위한 자동화 엔진과 함께 작동하는 초기화 시스템입니다. 이름 witchcraft - 사이버 보안을 위한 다용도 툴킷. 개요 witchcraft 모듈이름 옵션... 파일... IP... 설명 WITCHCRAFT는 NET 깊숙이 들어가는 러너들을 위해 만들어진 사이버덱 툴킷입니다...

research

보안 연구 이 저장소는 제가 발견한 보안 취약점CVE 연구를 위한 전용 저장소입니다. 이 저장소에는 발견된 취약점에 대한 상세한 기술 문서, 개념 증명PoC 익스플로잇, 그리고 분석 결과가 포함되어 있습니다. 소개 이 저장소는 제가 발견하고 연구한 모든 CVE를 모아 둔 곳으로, 다음을 포함합니다: 각 취약점에 대한 상세한 기술 분석 교육 목적의 개념 증명PoC 코드 공격 시나리오 및 영향 평가 수정 상태 및 패치 정보 공식 CVE 기록 참조 발견된 CVE CVE-2026-26158 - BusyBox 하드링크 우회 9.3 치명...

ROOT-OS-ALPINE-317-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.15. Multiple fixed versions available...

CVE-2025-60876

CVE-2025-60876: busybox wget 요청 대상 삽입 수정 CVE-2025-60876에 대한 동작을 유지하는 수정 사항입니다. 이는 BusyBox wget의 HTTP 헤더 삽입 취약점이며, 이를 증명하는 개념 증명PoC과 수정 사항을 BusyBox 업스트림에 제출하기 위한 아티팩트가 포함되어 있습니다. 취약점 BusyBox wget은 URL 경로와 쿼리를 HTTP 요청 라인에 그대로 복사합니다. 원시 CR0x0D, LF0x0A 또는 기타 제어 바이트를 포함하는 URL은 요청 라인을 분할하고 공격자가 제어하는 헤더...

CVE-2014-0196

참조 https://vulners.com/cve/CVE-2014-0196...

Linux Distros Unpatched Vulnerability : CVE-2026-88841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - busybox - None CVE-2026-88841 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-9.1.hum1 aarch64, x8664 busybox-petitboot-1.37.0-9.1.hum1 aarch64, x8664 busybox-shared-1.37.0-9.1.hum1 aarch64, x8664 busybox-1.37.0-9.1.hum1.src src Security Fixes:...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

Linux Distros Unpatched Vulnerability : CVE-2026-88835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out- of-bounds heap read. CVE-2026-88835 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2026-88831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. CVE-2026-88831 No...

Linux Distros Unpatched Vulnerability : CVE-2026-88830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-88840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. CVE-2026-88840 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-88839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of- bounds write of heap pointers. CVE-2026-88839 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...