fingerprint-pro-internals

Fingerprint Pro v4, deobfuscated and documented 143 signals named. The bundle unpacked. The wire format decoded. Run it on your browser · Read the docs · Signal map · Collector sources...

invisible_playwright

Free antidetect browser stealth for Playwright: undetected Firefox fingerprint, headless or headed. Python web scraping and captcha bypass. Open source, and it passes every bot detection test. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the...

CVE-2022-26138

CVE-2022-26138 CVE-2022-23131 - bypass SAML SSO root@kitploit: fofa: iconhash="-305179312"...

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Summary When a Java application connects with sslMode=verify-full or verify-ca and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer the "MITM-proof without a CA" feature and proves the server's identity...

GHSA-G9JJ-CGMH-9F38 MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Summary When a Java application connects with sslMode=verify-full or verify-ca and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer the "MITM-proof without a CA" feature and proves the server's identity...

zscan

zscan Uno strumento di rilevamento dei servizi veloce e personalizzabile, alimentato da un sistema di impronte digitali flessibile. Aiuta a identificare servizi, API e configurazioni di rete nella propria infrastruttura. Documentazione | Funzionalità | Installazione | Utilizzo ✨Funzionalità Motor...

Digital-Privacy

English | 简体中文 There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. Bruce Schneier《Applied Cryptography》 Inhalt : Informationsschutz,...

VULNERABLE-CVE-2024-45337

VULNERABLE-CVE-2024-45337 Um projeto de exemplo que demonstra código golang vulnerável ao CVE-2024-45337. Este é um projeto complementar a: https://github.com/NHAS/CVE-2024-45337-POC Para que você tenha algo para explorar. Uso root@kitploit: go run solver.go -authorised-pubkey ided25519.pub -allo...

pig_CS4.4

Nota: destinato esclusivamente alla ricerca sulla sicurezza e allo studio; se lo strumento viene utilizzato per altri scopi, l'utente si assume tutte le responsabilità legali e correlate; l'autore e il pubblicatore declinano ogni responsabilità legale e correlata. Cobalt Strike 4.4 Edizione Piggy...

thermoptic

thermoptic "لا أصدق ذلك، التمويه الحراري!" ما هو؟ هذا وكيل HTTP مصمم لتجاوز الخدمات التي تستخدم البصمات مثل JA4+ لحظر عملاء HTTP معيّنين. باستخدام هذا الوكيل، يمكنك استخدام عملاء HTTP المفضلين لديك مثل curl وتبقى بصماتك غير قابلة للتمييز بشكل سحري عن بصمات متصفح ويب حقيقي Chrome/Chromium. كما يأت...

rocacheck

rocacheck Package rocacheck ist eine Go-Implementierung des Schlüssel-Fingerabdruck-Algorithmus, der prüft, ob ein RSA-Schlüssel von defektem Infineon-Code erzeugt wurde und anfällig für die Faktorisierung durch die Return of Coppersmith's Attack ROCA / CVE-2017-15361 ist...

RustTLSX

RustTLSX 🦀 . Ein fortschrittlicher Stealth-HTTP-Client für Rust. Entwickelt für datenschutzbewusste Entwickler, die volle Kontrolle über ihren Netzwerk-Fingerprint benötigen. Sieht aus wie ein Browser. Verhält sich wie ein Browser. Geschrieben in Rust. Credits & Grundlage Basiert...

CVE-2026-81714

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81707

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81702

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

EUVD-2026-67063

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81714

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 are vulnerable to a plugin-signing trust anchor enrollment bypass in the enroll_trust_key function. The function uses suffix-tolerant fingerprint matching , so an operator who confirms a short (~32-bit) GPG key ID could unknowingly en...

CVE-2026-81707

openssl_encrypt versions before 1.4.9 fail to sanitize the email field in imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed in the terminal. The attack can be delivered through normal contact-exchange flows or ke...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...