Http-Asynchronous-Reverse-Shell

HTTP/S 非同期リバースシェル ✨ はじめに IDS、IPS、EDR、AV、ファイアウォールといった高度な検知システムが企業ネットワークを支配する時代において、オフェンシブセキュリティアセスメント中にそれらを回避することは課題です。ほとんどのリバースシェルはTCPトンネル（L4）を利用しており、現在では日常的に分析されフラグが立てられています。 このプロジェクトは革新的なソリューションを提供します : 正規のユーザー行動を模倣することで通常のWebトラフィックに溶け込む、HTTP/S上の完全非同期リバースシェルです。 従来のリバースシェルとは異なり、GETリクエスト...

CVE-2026-35616

CVE-2026-35616 作者：wa6n3r | GitHub | Web 描述 利用 Fortinet API 中证书链验证绕过漏洞。该脚本自动从多个来源发现有效的 Common Name CN，生成伪造的客户端证书，并使用 X-SSL-CLIENT-VERIFY 和 X-SSL-CLIENT-CERT 请求头向受保护的端点发起请求。 !!!重要 ：仅可在您拥有明确测试授权的系统上使用。 要求 Python 3.8+ 依赖项： requests cryptography urllib3 可选：openssl（用于通过 TLS 握手进行扩展的 CA 发现） 安装 克隆项目 git...

IBM MQ SSL Validation Bypass

A vulnerability exists in IBM MQ Message Queue that allows the bypassing of SSL certificate validation. By injecting a fake SSL certificate and using customized MQCONNX parameters, an unauthorized client connection to an IBM MQ server can be established...

CVE-2022-31083 Authentication bypass in Parse Server Apple Game Center auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

Parse Server 信任管理问题漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A trust management issue vulnerability exists in versions of Parse Server prior to 5.2.2 that stems from an unvalidated certificate in the Apple Game Center authentication adapter, which can be...

OpenSSL - Alternative Chains Certificate Forgery

OpenSSL - Alternative Chains Certificate Forgery !/usr/bin/env ruby encoding: ASCII-8BIT By Ramon de C Valle. This work is dedicated to the public domain. require 'openssl' require 'optparse' require 'socket' Version = 0, 0, 1 Release = nil class String def hexdumpstream=$stdout 0.stepbytesize - ...

OpenSSL Alternative Chains Certificate Forgery MITM Proxy

This module exploits a logic error in OpenSSL by impersonating the server and sending a specially-crafted chain of certificates, resulting in certain checks on untrusted certificates to be bypassed on the client, allowing it to use a valid leaf certificate as a CA certificate to sign a fake...

Threat Outbreak Alert: Fake Certificate Update Information Email Messages on January 13, 2014

Medium Alert ID: 32427 First Published: 2014 January 14 15:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain certificate update information attachment for the recipient. The text in the email message attempts to convinc...