crlf-desyncs

CRLF Desyncs Dies ist ein Repository mit nützlichen Tools und Ressourcen zum Erkennen und Ausnutzen von CRLF-basierten Desyncs, vorgestellt auf der BlackHat USA 2026 und der DEFCON 34. Inhalt cdn-origin/ - enthält aggregierte Origin-zu-Edge-Header, die zum Fuzzing einer CRLF-Injection in einer...

EUVD-2026-66493

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

wp2shell

wp2shell — Pre-Auth RCE in WordPress Core Nicht authentifizierte WordPress Core RCE PoC, die CVE-2026-63030 + CVE-2026-60137 verkettet. Nur für autorisierte Tests. wp2shell.py ist ein Proof-of-Concept, bestehend aus einer einzigen Datei, das ausschließlich die Standardbibliothek nutzt und zwei...

CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​这个JavaScript有效载荷使用 \alpha 常量来创建一个高频的"Memory Shiver"。它通过在WebKit垃圾回收器与GPU的Metal命令缓冲区之间制造不同步，触发CVE-2025-43529中的Use-After-Free（UAF）漏洞。 🍎 CTT-Apple-Silicon-Refraction WebKit/ANGLE 零日 "标签保护地址；CTT控制时间。" CVE-ID: CVE-2025-14174...

http-desync-guardian

अवलोकन HTTP/1.1 1991 से 2014 तक एक लंबे विकास से गुज़रा: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 - 2014...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Créditos para @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main para detalhes, leia: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Testado no Chromium 119.0.6045.123 compilado em Debian trixie/sid, rodando em Debian kali-rolling...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler أداة اختبار تهريب طلبات HTTP / عدم التزامن مكتوبة بلغة Python 3 شكر وتقدير شكر خاص لـ James Kettle على أبحاثه وطرقه في مجال عدم التزامن HTTP وشكر خاص أيضًا لـ Ben Sadeghipour على اختبار...

SilentMoonwalk

SilentMoonwalk PoC-Implementierung eines vollständig dynamischen Call-Stack-Spoofers TL;DR SilentMoonwalk ist eine PoC-Implementierung eines vollständig dynamischen Call-Stack-Spoofers, der eine Technik implementiert, um den ursprünglichen Aufrufer aus dem Call-Stack zu entfernen, indem ROP...

CVE-2026-80578

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80578 fbdev: core: Fix pointer desynchronization in fb_io_read()

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP-Schmuggel durch SAPs Haupteingang SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 und SAP Web Dispatcher sind anfällig für Request-Smuggling und Request-Verkettung. Ein nicht authentifizierter Angreifer kann...

CVE-2022-22536_SAP_Request_Smuggling_Scanner

Scanner per Request Smuggling SAP CVE-2022-22536 Questo è uno scanner batch rapido a livello di socket per CVE-2022-22536 , una vulnerabilità critica di request smuggling in SAP Internet Communication Manager ICM e SAP Web Dispatcher. Testa più host in parallelo per rilevare comportamenti di...

crlf-powered-desync-scanner

Scanner di Desync Basato su CRLF Questa è l'estensione Burp che abbiamo utilizzato per rilevare tutti i casi della nostra ricerca CRLF-Powered Desync Attacks: Beheading HTTP Streams. È uno scanner pensato principalmente per la ricerca, costruito usando BulkScan, simile a HTTP Request Smuggler e...

CVE-2026-72714

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to...

echteeteepee

Ferramentas de Teste de Vulnerabilidade de Dessincronização HTTP/1 Este repositório contém ferramentas de segurança defensiva para detectar vulnerabilidades de contrabando de requisições HTTP/1 dessincronização com base na pesquisa inovadora de James Kettle da PortSwigger. Atribuição da Pesquisa...

http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 - 2014...

wp2shell-checker

root@kitploit: \ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Rivelatore checker per la RCE pre-auth della REST Batch API del WordPress Core Creato da 0xjessie21 — Cybersecurity...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE Un'analisi tecnica di CVE-2026-63030, un bug logico nell'endpoint batch dell'API REST del core di WordPress che consente a una richiesta anonima di essere eseguita sotto la rotta e il controllo dei permessi di una richiesta diversa, concatenandosi in CVE-2026-60137 S...