Important: Red Hat Security Advisory: containernetworking-plugins security update

An update for containernetworking-plugins is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

go-pkcs12

package pkcs12 root@kitploit: import "software.sslmate.com/src/go-pkcs12" Package pkcs12 implements some of PKCS12 also known as P12 or PFX. It is intended for decoding DER-encoded P12/PFX files for use with the crypto/tls package, and for encoding P12/PFX files for use by legacy applications whi...

flare-floss

FLOSS Scripts FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory. Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA...

netpwn

netpwn A framework made to automate tasks of pentesting. Written in python 2.7 Modules reverseshell - Creates a reverse shell with python to connect to a specific machine of your choice. sendfile - Allows you to send a file to target server. phpbackdoor - Generates a simple backdoor in php upload...

physical-bitcoin-attacks

Known Physical Bitcoin Attacks A list of known attacks against Bitcoin / crypto asset owning entities that occurred in meatspace. NOTE: this list is not comprehensive; many attacks are not publicly reported. If you are aware of an attack that is not listed, please open an issue or pull request. F...

Crypto <= 2.15 - Authentication Bypass

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'cryptoconnectajaxprocess::login' function in the 'cryptoconnectajaxprocess' function. This makes it possible for unauthenticated...

CVE-2022-20866

RSA Key Checker for CVE-2022-20866 A vulnerability in the handling of RSA keys on devices running the Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software could allow an unauthenticated, remote attacker to retrieve the RSA private key. This vulnerability is due to a...

CVE-2020-0601

CVE-2020-0601 CVE-2020-0601 - A Windows Crypto Exploit...

signy

signy Signed URLs for small devices. Background signy is a library for generating signed URLs on embedded devices using asymmetric cryptography. Signed URLs are typically utilized to grant time-limited access to private resources, such as those served by a Content Delivery Network CDN. In the...

cryptodev-linux

cryptodev-linux This is a /dev/crypto device driver, equivalent to those in OpenBSD or FreeBSD. The main idea is to access existing ciphers in kernel space from userspace, thus enabling the re-use of a hardware implementation of a cipher. For questions and suggestions, please use the homepage at...

kangaroo

Kangaroo GPU-accelerated Pollard's Kangaroo algorithm for solving the Elliptic Curve Discrete Logarithm Problem ECDLP on secp256k1. Features 🖥️ Cross-platform GPU — Vulkan AMD, NVIDIA, Intel, Metal Apple Silicon, DX12 Windows via wgpu 🦀 Pure Rust + WGSL — no CUDA dependency, compute shaders...

curveball

curveball CVE-2020-0601 curveball - Alternative Key Calculator Build Windows Visual Studio 2012 or , then build the solution. Linux / Unix cc altkey.c -lcrypto -o altkey Usage Usage: altkey ecpubliccertificate.pem ecnewprivatekey.pem Example root@kitploit: C:\security\curveball\Releasealtkey...

xortool

xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...

replica

REPLICA TAME THE DRAGON ✨Features ⚡ Disassemble missed instructions - Define code that Ghidra's auto analysis missed ⚡ Detect and fix missed functions - Define functions that Ghidra's auto analysis missed ⚡ Fix 'undefinedN' datatypes - Enhance Disassembly and Decompilation by fixing 'undefinedN'...

CVE-2025-29775

SAMLStorm CVE-2025-29775 Lab Environment This is a lab environment for demonstrating the SAMLStorm vulnerability CVE-2025-29775 that affects the xml-crypto library and SAML implementations in Node.js. Note: This is not a true exploitation of the vulnerability, just a recreation to demonstrate how...

grapefruit

Grapefruit：开源移动安全测试套件 基于 Frida 的运行时移动应用插桩工具包。 通过 Web 界面检查、Hook 和修改移动应用。 现在它同时支持 iOS 和 Android！ 快速入门 首先，需要设备上运行 Frida 服务端。请先按照官方安装指南（Android）操作。 npm（推荐，需要 Node.js 22.18+） root@kitploit: npm install -g igf igf 或无需安装直接运行（需要 Node.js 22.18+） root@kitploit: npx igf 预编译二进制 适用于 macOS、Linux 和 Windows，可从...

2018-QWB-CTF

2018-QWB-CTF 2018 Qiangwangbei CTF Challenge Collection root@kitploit: │ ├── 01Misc-4题 │ ├── 题目名称：ai-nimals │ │ └── 题目名称：ai-nimals.mhtml │ ├── 题目名称：welcome │ │ └── 题目名称：welcome.mhtml │ ├── 题目名称：签到 │ │ └── 题目名称：签到.mhtml │ └── 题目名称：问卷调查 │ └── 题目名称：问卷调查.mhtml ├── 02Crypto-5题 │ ...

Log4j-Vulnerability

Log4j Vulnerability Tutorial: https://youtu.be/PNDBjoT83zA Tutorial: https://cryptodeeptech.ru/log4j-vulnerability Background on Log4j Alibaba Cloud Security Team publicly disclosed a critical vulnerability CVE-2021-44228 enabling unauthenticated remote code execution against multiple versions of...

boha

@agntn/puzzles 348 public crypto puzzles and bounties in twenty collections, as typed records. You ask for a puzzle, you get its address, its key material and what happened on chain. Why? Every puzzle thread has the same three things: the addresses, the prizes, and who solved what. Every scanner...

laravel-crypto-killer

Laravel crypto killer 一款旨在利用 Laravel 应用中解密机制错误实现的工具。 该工具最初设计用于针对 Illuminate\Encryption 包中 Laravel decrypt 函数构造 payload。 它也可以用于解密通过 encrypt 或 encryptString 加密的任何数据。 该工具需要有效的 APPKEY 才能使用；如果你认为可能存在密钥重用（例如来自公共项目），也可以尝试暴力破解。 工具作者：@remsio @Kainx42。 用法 每个选项都可以使用帮助信息来操作该工具： root@kitploit: $...