dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

CVE-2026-20660

CVE-2026-20660 PoC Bundle This folder packages a standalone proof-of-concept for: CVE-2026-20660 CFNetwork NSGZipDecoder path traversal via gzip FNAME Impact on vulnerable macOS Safari with auto-open enabled 1. Directory Layout server.py: Main PoC server with configurable traversal depth and...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

Powshell-decode-payload

decode powershell gzip code sal a New-Object;a IO.StreamReadera IO.Compression.GZipStreamIO.MemoryStreamConvert::FromBase64String'xxxx',IO.Compression.CompressionMode::Decompress,Text.Encoding::ASCII.ReadToEnd sal a New-Object;a IO.StreamReadera...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

CVE-2026-128131

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

CVE-2026-128131

The aiohttp asynchronous HTTP client/server framework for asyncio and Python (versions prior to 3.14.4 ) is vulnerable to a quadratic CPU use issue. When processing payloads with concatenated gzip, deflate, or zstd streams, the software passes the entire remaining input to a new decompressor for ...

CVE-2026-128131 AIOHTTP: Concatenated compressed streams cause excessive CPU use

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

EUVD-2026-125699

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled byt...

CVE-2026-128242

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form...

CVE-2026-128242 actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form...

CVE-2026-128242 actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form...

EUVD-2026-125050

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form...

CVE-2026-128242

The actix-http (before 3.20.1) and actix-web (before 4.18.2) libraries contain an unbounded decompression vulnerability in the encoding::Decoder component. A remote attacker can trigger a Denial of Service (DoS) by sending small, highly compressed request bodies using gzip, deflate, Brotli, or zs...

CVE-2026-124738

A flaw was found in BusyBox. When the HTTP daemon httpd has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file pat...

CVE-2026-124738

A flaw in BusyBox allows a remote attacker to bypass password rules for pre-compressed .gz files when the HTTP daemon (httpd) has pre-compressed file support enabled. The vulnerability occurs because authentication checks are evaluated against the requested URL path instead of the actual pre-comp...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...