PyExfil

PyExfil Tests de détection et créativité PyExfil est né comme une preuve de concept PoC et une sorte de terrain de jeu, puis a grandi pour devenir quelque chose d'un peu plus. À mes yeux, c'est toujours un PoC désordonné qui a besoin de beaucoup plus de travail et de tests pour devenir stable. Le...

Amsi_Bypass_In_2023

Обход AMSI в Windows 11 в 2023 году Технические подробности можно найти в статье: https://medium.com/@gustavshen/bypass-amsi-on-windows-11-75d231b2cac6 AttackAmsiOpenSession.ps1 root@kitploit: HRESULT AmsiOpenSession in HAMSICONTEXT amsiContext, out HAMSISESSION amsiSession ; Этот PowerShell-скри...

Papers

Этот репозиторий предназначен для размещения моих исследовательских работ. Подпишитесь на него, если хотите читать больше моих материалов. Обход механизмов обнаружения XSS Скачать PDF Фонетический подход к вычислению лингвистической информации в тексте Скачать PDF...

SigFlip

Qu'est-ce que c'est ? SigFlip est un outil pour patcher des fichiers PE signés avec Authenticode exe, dll, sys, etc. sans affecter ni casser la signature Authenticode existante. En d'autres termes, vous pouvez modifier le checksum/hash d'un fichier PE en y intégrant des données par exemple, du...

crypter

Crypter Ce Crypter est écrit en Python 3, et peut être utilisé pour obscurcir et chiffrer le code source Python afin de contourner les antivirus. Il est également capable de contourner les machines virtuelles telles que VirtualBox, VMware, Sandboxie. Utilise le chiffrement AES-256 bits et...

invisible_playwright

Free antidetect browser stealth for Playwright: undetected Firefox fingerprint, headless or headed. Python web scraping and captcha bypass. Open source, and it passes every bot detection test. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the...

avpass

AVPASS AVPASS est un outil permettant de divulguer le modèle de détection des systèmes de détection de malwares Android c'est-à-dire les antivirus et de contourner leur logique de détection en utilisant les informations divulguées couplées à des techniques d'obfuscation d'APK. AVPASS ne se limite...

SpookFlare

SpookFlare SpookFlare предлагает иной подход к обходу мер безопасности и даёт вам возможность обходить средства защиты конечных точек как на стороне клиента, так и на стороне сети. SpookFlare — это генератор загрузчиков/дропперов для Meterpreter, Empire, Koadic и др. SpookFlare обладает функциями...

CVE-2026-31431-detection-defense

CVE-2026-31431: 기존 탐지를 우회하는 iouring에 대한 탐지 및 방어 저자 : fz0x00, qiwuSEC 연구 CVE-2026-31431"Copy Fail"에 대해, 우리는 세 가지 우회 전략을 결합하여 주류 보안 제품의 체계적인 취약점을 입증했습니다: iouring 비동기 I/O 경로 , 프로세스 분할fork + SCMRIGHTS , 그리고 소켓 재사용. 실증 테스트를 통해 이러한 기법이 사실상 모든 syscall 기반 탐지 도구를 회피할 수 있음을 증명했습니다. 주요 발견 사항 1. iouring은 사실상...

AMSI-ETW-Patch

AMSI-ETW-Patch questa repo contiene informazioni per patchare AMSI ed ETW usando una patch a singolo byte per entrambi. L'idea era limitare il rilevamento della patch stessa dato che è un singolo byte. AMSI patch-amsi-x64.c L'idea è che AMSI esegua molti controlli di validazione prima di...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-58646

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-64796

CVE-2026-64796 concerns the Joomla Sourcerer extension by regularlabs.com, with multiple code injection vectors. The Free version allegedly lets both the article creator and last modifier execute article PHP without needing Super User privileges; the Pro version reportedly fails to consistently e...

PYSEC-2026-1369 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...

PYSEC-2026-1784 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Summary Using idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity functio...

PYSEC-2026-1788 Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL. Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...

CVE-2025-71373 picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on...

CVE-2025-71373 picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on...

CVE-2025-71373

CVE-2025-71373 : picklescan before 0.0.33 fails to detect operator.methodcaller calls in pickle files, allowing remote attackers to craft payloads that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.