bluffs

BLUFFS はじめに このリポジトリには、 BLUFFS: Bluetoothの前方秘匿性と未来秘匿性に対する攻撃と防御に関連するコードが含まれています。 論文概要...

FShell

FShell 説明 FShellはForward Shellの私の実装です。ステートレスプロトコル（例：HTTP）を介したリモートコード実行を使って、インタラクティブなttyを取得するように設計されています。 なぜフォワードシェルを使うべきなのか？ リモートサーバーがインターネットに到達できないため、リバースシェルの可能性がない サーバーに新しい外向き接続を開始させたり、新しいサービスを公開させたくない（脆弱な公開サービスのみを使用する） ただし、欠点もあります。 毎秒多くのリクエストが発生する（Webサーバーの場合、多くのアクセスログが生成される） 完全なインタラクティブではない:...

DFShell

root@kitploit: ██████╗ ███████╗███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║█████╗ ███████╗███████║█████╗ ██║ ██║ ██║ ██║██╔══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║ ██████╔╝██║ ███████║██║ ██║███████╗███████╗███████╗ ╚═════╝ ╚═╝ ╚══════╝╚═╝...

gtunnel

Documentation can be found at: https://hotnops.gitbook.io/gtunnel/...

spamscanner

Spam Scanner is the best anti-spam, , and service...

cve-2022-31692

CVE-2022-31692 デモ 概要 CVE-2022-31692 に対して脆弱な構成を示す、シンプルな Spring Boot アプリケーションです。 この脆弱性は、その深刻度から注目を集める可能性があります。認証バイパスを可能にするため、CVSS 3.x の基本スコアは 9.8 です。 このプロジェクトの目的は、アドバイザリに記載されている、脆弱性が適用可能となる条件を示すことです。 アプリケーションは、Spring Security がフォワードおよびインクルードのディスパッチャタイプにセキュリティを適用することを期待しています。 アプリケーションは、手動で、または...

iox

iox English | 中文 포트 포워드 및 인트라넷 프록시를 위한 도구로, lcx/ew와 비슷하지만 더 나은 기능을 제공합니다. 왜 작성했는가? lcx와 ew는 훌륭하지만 개선의 여지가 있습니다. 처음 사용했을 때, tran, slave, rcsocks, sssocks...와 같은 복잡한 매개변수를 오래 기억하지 못했습니다. 작업 모드는 명확한데 왜 이런 식으로 매개변수를 설계했을까요? 특히 ew의 -l -d -e -f -g -h 게다가 네트워크 프로그래밍 로직도 최적화될 수 있다고 생각합니다. 예를 들어, lcx...

CVE-2026-31908

CVE-2026-31908 - Apache APISIX ヘッダーインジェクションエクスプロイト 📋 概要 これは CVE-2026-31908 の 概念実証（PoC） エクスプロイトです。Apache APISIX のバージョン 2.12.0 から 3.15.0 で発見された、重大なヘッダーインジェクションの脆弱性です。 この脆弱性は forward-auth プラグインに存在し、CRLF（\r\n）シーケンスの不適切なサニタイズにより、認証されていない攻撃者が悪意のある HTTP ヘッダーを注入できるようになります。これにより、、、保護されたリソースへのが発生する可能性があります...

CVE-2026-91777 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-91777 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-94102

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

CVE-2026-94102

An open redirect vulnerability exists in WuzhiCMS up to 4.1.0 , specifically in the Login component at /index.php?m=member&v=Login. The root cause is that the forward argument is only sanitized by remove_xss(), an XSS keyword/entity scrubber, which is insufficient to prevent a crafted redirect UR...

EUVD-2026-83814

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...