certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

EUVD-2026-112725

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

certificate-ripper

Certificate Ripper 🔐 A CLI tool to extract server certificates Demo Advantages It is fast Easy to use No openssl required Runs on any Operating System Can be used with or without Java, native executables are present in the releases Extracts all the sub-fields of the certificate Certificates can b...

SAMLRaider

SAML Raider - SAML2 Burp Extension Description SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates. This software was created by Roland Bischofberger and Emanuel Duss during a bachel...

Curveball

Curveball A PoC for CVE-2020-0601. A detailed blog post can be found here. This exploit allows you to create a fake trusted certificate by abusing how CryptoAPI handles certain parameters on ECC based certificates. Setup Clone the repository and open it in Visual Studio 2019. Switch to Release an...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

attezt

attezt attezt is a suite of remote attestation tools. It provides several components that allows Linux systems to have hardware backed device certificates over the device-attest-01 ACME challenge. This is useful for environments where you want a strong device identity claim for things like x509...

CVE-2026-105031

The Apache Qpid Proton C library (versions through 0.40.0 ) is vulnerable when using the OpenSSL TLS implementation. The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs incorrectly append to, rather than replace, default system trust anchors. This behavior can lead to...

AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. Network Connections & SSL/TLS Configuration Process Hacker memory analysis reveals that AcrStealer establishes network connections using SSL/TLS for secure communication with its C2 server. Key Observations: SslClientCert – Uses client certificates for authentication evades detection...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

ghostbuster

Table of Contents Table of Contents Ghostbuster The problem Project Features Installing Ghostbuster Using Ghostbuster Example Output Setting up your AWS accounts Setting up Cloudflare Optional Authors License Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources with...

CloudPulse

CloudPulse - AWS Cloud Landscape Search Engine During the reconnaissance phase, an attacker searches for any information about his target to create a profile that will later help him to identify possible ways to get in an organization. CloudPulse is a powerful tool that simplifies and enhances th...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

BIT-OPENBAO-2026-115359 OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

CVE-2024-7344

🐞 CVE-2024-7344: Improper PE Image Loading This repository contains research material related to CVE-2024-7344, a Secure Boot bypass vulnerability affecting UEFI systems. It centralizes technical analysis of the vulnerability, attack flow documentation, and recreated applications designed to...

BIT-GOLANG-2026-111943 Distrust compromised intermediate certificates in crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...

ADCSync

ADCSsync This is a tool I whipped up together quickly to DCSync utilizing ESC1. It is quite slow but otherwise an effective means of performing a makeshift DCSync attack without utilizing DRSUAPI or Volume Shadow Copy. This is the first version of the tool and essentially just automates the proce...