NimicStack

NimicStack NimicStack è l'implementazione in puro Nim della tecnica di Call Stack Spoofing per imitare programmi legittimi. L'intero progetto si basa sulla PoC condivisa da WithSecure Labs Compilazione Puoi compilare direttamente il codice sorgente con il seguente comando: nim c -d=mingw...

Unwinder

Contenuto SilentMoonWalk Descrizione Crediti Utilizzo Macro callfunction! Macro indirectsyscall! Passaggio dei parametri Esempi Chiamare kernel32.dll!Sleep Chiamare kernel32.dll!OpenProcess Chiamare NtDelayExecution come syscall indiretta Concatenare chiamate di macro Considerazioni Frame inizial...

SilentMoonwalk

SilentMoonwalk Implementazione PoC di uno spoofing dello stack di chiamate completamente dinamico TL;DR SilentMoonwalk è un'implementazione PoC di uno spoofing dello stack di chiamate completamente dinamico, che implementa una tecnica per rimuovere il chiamante originale dallo stack di chiamate,...

Shelter

Shelter Shelter é uma técnica de ofuscação de sono completamente instrumentalizada que permite criptografar totalmente seu payload na memória, fazendo uso extensivo de ROP. Este crate oferece as seguintes características: Criptografia AES-128. Capacidade de criptografia total do PE. Remoção da...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC Una implementazione PoC per una tecnica avanzata di evasione in-memory che falsifica lo Stack dei Thread. Questa tecnica permette di bypassare le regole di esame della memoria basate sui thread e nascondere meglio gli shellcode mentre sono in memori...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

LazyHook

Übersicht LazyHook ist ein heimliches API-Hooking-Framework, das Host Intrusion Prevention Systems HIPS durch Call-Stack-Spoofing umgeht. Durch die Nutzung von CPU-Level-Hardware-Breakpoints und Vectored Exception Handling wird beliebiger Code so ausgeführt, als stamme er von vertrauenswürdigen,...

CallStackSpoofer

CallStackSpoofer Questo repository dimostra un'implementazione PoC per spoofare call stack arbitrarie quando si effettuano chiamate di sistema. Per una descrizione tecnica completa, consulta il post del blog qui: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. Di default...

CallStackMasker

CallStackMasker यह रिपॉजिटरी टाइमर का उपयोग करके कॉल स्टैक्स को गतिशील रूप से स्पूफ करने की एक PoC तकनीक प्रदर्शित करती है। हमारे इम्प्लांट के सोने से पहले, हम टाइमर को क्यू कर सकते हैं ताकि इसके कॉल स्टैक को एक नकली स्टैक से ओवरराइट किया जा सके और फिर निष्पादन फिर से शुरू करने से पहले मूल को...

EUVD-2026-63468

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scs: A wrong parameter was fixed in scsmagic. The scsmagic function requires a void variable, but a struct taskstruct is provided instead. taskscstsk represents the starting address of the task’s shadow call stack, and...

SUSE CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...

CVE-2026-67312

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. When an application passes attacker-controlled FormData field names...

SUSE CVE-2026-63864

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...

CVE-2026-48712

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject conversion and the custom google.protobuf.Any JSON conversio...

CVE-2026-48712

The CVE-2026-48712 vulnerability affects protobufjs (JavaScript) in the toObject() conversion path and the google.protobuf.Any JSON conversion path. Prior to versions 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit when converting decoded messages to plain objects/JSON, allowing a...

CVE-2026-41673

A flaw was found in the xmldom library, a JavaScript module for parsing XML documents. An attacker could exploit this vulnerability by providing a specially crafted, deeply nested XML document. This could lead to a Denial of Service DoS by causing the application to crash due to excessive...