Matroschka

Матрёшка About Matroshka is a command-line steganography tool written in pure Python. You can use it to hide and encrypt images or text in the least significant bits of pixels in an image. Encryption The encryption uses HMAC-SHA256 to authenticate the hidden data. Therefore the supplied MAC...

BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 is an encrypted remote administration and C2 framework designed exclusively for educational use, security research, and controlled laboratory environments. The project demonstrates how to build a custom command-and-control server with application-layer...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

CVE-2015-9235_JWT_key_confusion

英文 描述 此应用程序允许您替换 JSON Web 令牌 JWT 中的值，并使用 HMAC-SHA256 方法重新计算签名。它接受一个令牌、一个要替换的键以及与该键关联的新值作为输入。 用法 克隆或下载应用程序的源代码。 git clone https://github.com/WinDyAlphA/CVE-2015-9235JWTkeyconfusion cd CVE-2015-9235JWTkeyconfusion 文件 token.txt 包含一个有效的 JWT 令牌作为示例。您可以修改它或将其替换为您自己的令牌。 使用命令行运行应用程序，并提供适当的参数： python...

scadapack-secure-lock-poc

Verificador de fixture de bloqueo seguro SCADAPack Este repositorio es una prueba de concepto deliberadamente acotada para CVE-2026-81861. Verifica que dos fixtures controlados producidos con el DTM de Windows enviado por el proveedor pueden autenticarse y decodificarse utilizando material de cla...

Grafana-Password-Decryptor

Grafana Password Decryptor Python toolkit for decrypting and cracking Grafana passwords from multiple formats. Coded by: strikoder What Does This Tool Do? Handles two types of Grafana password storage: 🔐 AES-256 Base64 datasource table → Decrypt directly with AESDecrypt.py 🔨 PBKDF2HMACSHA256 user...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

GHSA-XCW4-53CC-HV32 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

Exploit for CVE-2026-44351

CVE-2026-44351 — Falsificación de JWT por Secret Vacío en fas...

EUVD-2026-76155

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser. Attacker...

CVE-2026-72709

SPIP before 4.4.18 is affected by a missing authorization vulnerability in the administrative action endpoints under ecrire/action/. The root cause is the absence of a server-side permission check via autoriser(): an unauthenticated attacker can obtain a valid HMAC-SHA256 nonce, compute it for an...

CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

Exploit for CVE-2026-81861

SCADAPack Secure Lock fixture verifier This repository is a d...

PT-2026-89912

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF Cross-Site Request Forge...

CVE-2026-81718: Inadequate Encryption Strength

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

PT-2026-79556

Name of the Vulnerable Software and Affected Versions Punk versions prior to 0.18 Description Punk for Perl allows session cookie forgery when a session is declared without a secret. The session keyword does not require a secret or issue a warning when one is absent, causing the cookie read and...

CVE-2026-75870: Use of Default Cryptographic Key

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

EUVD-2026-62350

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...