universal-flutter-ssl-pinning

universal-flutter-ssl-pinning 使用 PyGhidra 对 libflutter.so 进行逆向工程，定位 SSL 证书验证函数，然后生成即开即用的绕过脚本，适用于 Frida 和 Renef 。 工作原理 1. PyGhidra 以无头模式加载 libflutter.so，并扫描所有已定义的字符串，寻找 sslclient 2. 解析该字符串的交叉引用，定位到其所属的函数 3. 对每个函数进行反编译，获取准确的参数个数 4. 选择具有 3 个参数的函数——这就是 sslcryptox509sessionverifycertchain 5. 将其 RVA...

poc-CVE-2026-0073

CVE-2026-0073 PoC（无线 ADB TLS 认证绕过） 该目录包含针对 CVE-2026-0073 的 Python 概念验证脚本。 该脚本使用 AI 辅助代码生成技术生成。 概述 CVE-2026-0073 是 ADB 守护进程证书验证（auth.cpp 中的 adbdtlsverifycert）中的一个逻辑问题。 存在漏洞的检查逻辑将 EVPPKEYcmp... 的任何非零返回值都视为成功匹配。 预期的比较结果处理应为： 1 = 密钥匹配 0 = 密钥不匹配 负值 = 错误 / 不支持的比较 在存在漏洞的构建版本中，负值会被视为真值，从而可能错误地将证书标记为已授权。...

pwnage24mtk

pwnage24mtk 针对MTK设备的证书利用。MTK证书验证过程中存在逻辑缺陷。类似于CVE-2023-20696。 已修补。 CVE-2023-20696 CVE-2025-20730 架构检测存在一些问题。等我有空时需要修复。或者任何人都可以提交pull request。 这是一个vibe编码的版本，我稍后会重写。但目前是可用的。 免责声明 本项目仅用于研究目的。 请确保在使用前已获得授权。 不允许用于非法用途。 不允许使用此漏洞提供付费服务。 对于MTK设备，preloader验证bl2ext/lk/atf，然后跳转到该镜像。 这些镜像是使用ASN.1证书签名的。...

ibmsecurity

IBM Sample Code Este repositorio contiene código Python para gestionar IBM Security Appliances mediante sus respectivas API REST. El appliance ISAM es el que tiene el código más maduro. El código para el appliance ISDS está en desarrollo. El código para el appliance ISVG es nuevo probado solo con...

sslnuke

sslnuke —— 未经验证的 SSL 并不安全！ 我们都不止一次地听说过，未经验证的 SSL 并不安全。 如果 SSL 连接没有使用缓存的证书进行验证，那么任何攻击者都可以轻易地劫持它。 因此，在 2013 年，人们可能会认为我们已经彻底解决了这个问题。 浏览器会缓存证书，并在站点提供自验证证书（不应被信任）时非常醒目地警告用户， 浏览器厂商基本上已经解决了这个问题。然而，HTTPS 并不是唯一使用 SSL 的协议。 不幸的是，许多其他协议的客户端默认不进行验证，即使它们进行了验证，也无法保证证书的安全传输。 毕竟，有多少人愿意为自己的 FTPS 服务器花 50 美元购买 SSL...

nogotofail

nogotofail Nogotofail 是一个网络安全测试工具，旨在以灵活、可扩展且强大的方式帮助开发者和安全研究人员发现并修复设备及应用程序中弱的 TLS/SSL 连接和敏感的明文流量。它包含对常见 SSL 证书验证问题、HTTPS 和 TLS/SSL 库漏洞、SSL 和 STARTTLS 剥离问题、明文问题等的测试。 设计 Nogotofail 由一个路径上的网络 MiTM 和可选的要测试设备上的客户端组成。有关 nogotofail 的概述和设计目标，请参见 docs/design.md。 依赖项 Nogotofail 仅依赖 Python 2.7 和...

p5-ssl-tools

Colección de Herramientas SSL Este repositorio contiene varias herramientas, destinadas a depurar o analizar problemas relacionados con SSL/TLS. Análisis del estado de TLS analyze-ssl.pl comprueba el soporte de varias versiones de SSL/TLS comprueba qué cifrados son compatibles verifica el...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

EUVD-2026-70494

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...

poc-CVE-2026-0073

CVE-2026-0073 PoC Wireless ADB TLS Auth Bypass This directory contains a Python proof of concept for CVE-2026-0073. The script is generated using AI-assisted code generation techniques. Summary CVE-2026-0073 is a logic issue in ADB daemon certificate verification adbdtlsverifycert in auth.cpp. Th...

CURL-CVE-2026-80230 OpenSSL pinning bypass

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-54876

A flaw was found in OpenSSL. A malicious TLS Transport Layer Security server can exploit this vulnerability by sending a specially crafted OCSP Online Certificate Status Protocol response during the X.509 certificate chain verification process. This can lead to a memory leak in client application...

CVE-2026-19854

CVE-2026-19854 affects the ClickHouse plugin (Grafana) when it uses the Native protocol (the default) together with PDC or secure SOCKS . The root cause is that the underlying connection library requests TLS but then ignores it, resulting in plaintext communication with ClickHouse. Concretely, us...

CVE-2026-19854 CVE-2026-19854 CVE Record

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

CVE-2026-81034

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a...

Astra Linux – Vulnerability in Twisted

In words.protocols.jabber.xmlstream in Twisted through version 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to intercept connections...