CVE-2026-31431-detection-defense

CVE-2026-31431: iouring मौजूदा डिटेक्शन को बायपास करने का पता लगाना और उससे बचाव लेखक : fz0x00, qiwuSEC शोध CVE-2026-31431 "Copy Fail" के लिए, हमने तीन बायपास रणनीतियों को मिलाकर मुख्यधारा के सुरक्षा उत्पादों में व्यवस्थित कमजोरियों का प्रदर्शन किया: iouring async I/O पथ , प्रोसेस स्प्लिटिंग fork...

Amsi_Bypass_In_2023

2023 में Windows 11 पर Amsi Bypass तकनीकी विवरण लेख में पाए जा सकते हैं: https://medium.com/@gustavshen/bypass-amsi-on-windows-11-75d231b2cac6 AttackAmsiOpenSession.ps1 root@kitploit: HRESULT AmsiOpenSession in HAMSICONTEXT amsiContext, out HAMSISESSION amsiSession ; यह PowerShell स्क्रिप्ट...

AMSI-ETW-Patch

AMSI-ETW-Patch este repositório contém informações para aplicar patch no AMSI e no ETW usando um patch de um único byte para ambos. A ideia era limitar a detecção do próprio patch, já que é um único byte. AMSI patch-amsi-x64.c A ideia é que o AMSI realiza muitas verificações de validação antes de...

Papers

此仓库旨在托管我的研究论文。如果你想阅读我更多的内容，请点击关注。 绕过XSS检测机制 下载PDF 一种计算文本中语言信息的语音学方法 下载PDF...

PyExfil

PyExfil اختبار الإجهاد للكشف والإبداع ولدت PyExfil كدليل على المفهوم PoC ونوع من الملعب، ثم نمت لتصبح شيئًا أكبر. في نظري، ما زالت PoC فوضوية تحتاج إلى الكثير من العمل والاختبار لتصبح مستقرة. الغرض من PyExfil هو تجميع أكبر عدد ممكن من تقنيات التسريب، والآن أيضًا تقنيات الاتصالات، التي يمكن...

avpass

AVPASS AVPASS è uno strumento per divulgare il modello di rilevamento dei sistemi di rilevamento malware Android cioè, i software antivirus e bypassare le loro logiche di rilevamento utilizzando le informazioni divulgate insieme a tecniche di offuscamento APK. AVPASS non si limita alle...

crypter

Crypter Questo Crypter è scritto in Python 3, che può essere utilizzato per offuscare, crittografare il codice sorgente Python per bypassare l'AntiVirus. In grado anche di bypassare VM come VirtualBox, VMware, Sandboxie. Utilizza crittografia AES-256 bit e codifica Base64 per crittografare il...

SigFlip

Cos'è? SigFlip è uno strumento per modificare file PE firmati con authenticode exe, dll, sys ..etc in modo che non influisca o rompa la firma authenticode esistente. In altre parole, è possibile modificare il checksum/hash del file PE incorporando dati ad esempio shellcode senza rompere la firma...

SpookFlare

SpookFlare SpookFlare ha una prospettiva diversa per aggirare le misure di sicurezza e ti dà l'opportunità di bypassare le contromisure degli endpoint a livello di rilevamento lato client e lato rete. SpookFlare è un generatore di loader/dropper per Meterpreter, Empire, Koadic, ecc. SpookFlare...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-58646

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-64796

CVE-2026-64796 concerns the Joomla Sourcerer extension by regularlabs.com, with multiple code injection vectors. The Free version allegedly lets both the article creator and last modifier execute article PHP without needing Super User privileges; the Pro version reportedly fails to consistently e...

PYSEC-2026-1369 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...

PYSEC-2026-1784 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Summary Using idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity functio...

PYSEC-2026-1788 Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL. Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...

CVE-2025-71373 picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on...

CVE-2025-71373

CVE-2025-71373 : picklescan before 0.0.33 fails to detect operator.methodcaller calls in pickle files, allowing remote attackers to craft payloads that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

CVE-2025-71373 picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on...

CVE-2025-71367

picklescan before 0.0.34 fails to detect operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using operator.attrgetter in reduce methods to execute arbitrary code when pickle.load processes the file...