WebGoat.NET

Webgoat.NET Source Code: https://github.com/jerryhoff/WebGoat.NET Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web...

NxRansomware

NxRansomware A next generation of ransomware. Fully written using a .Net Framework + C&C System Created By: Guilherme Bacellar Moralez Disclaimer This code is created and maintened only for a research proposal. Please do not use for other proposes. Please, do not run the code with a release...

CVE-2026-94423

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

ReClass.NET

ReClass.NET This is a port of ReClass to the .NET platform with lots of additional features. Features Support for x86 / x64 File import from ReClass 2007-2016 and ReClass QT Memory Nodes Arrays and Pointers to every other node types Hex 8 / 16 / 32 / 64 Int 8 / 16 / 32 / 64 UInt 8 / 16 / 32 / 64...

VulnerableDotNetHTTPRemoting

Vulnerable Dot Net HTTP Remoting Project This repository contains a vulnerable C application client/server that uses .NET Remoting over HTTP. This can be used for testing purposes and can be compiled using different versions of .NET Framework. It also includes a copy of ysoserial.net 15/03/2018...

SharpShooter

/ // / / // / / / \ / / / / \ / / / / / / / / / / / / // / / / // // / / / / // / // / // / / /// //,// / ./// /////// // Description SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of creating...

CVE-2026-94423

The Net::LibSSH Perl binding for versions before 0.004 is vulnerable to authentication bypass because the connect function fails to verify the host key against known_hosts. While the underlying libssh library leaves host key verification to the application, this specific binding fails to implemen...

CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

AoratosWin

AoratosWin AoratosWin is a tool that removes traces of executed applications on Windows OS which can easily be listed with tools such as ExecutedProgramList by Nirsoft. Feel free to decompile, reverse, redistribute, etc. Supported OS Tested On Windows 7 x86, x64 Windows 8 x86, x64 Windows 8.1 x86...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

PoshSecFramework

PoshSec Framework For the Scripts and Modules to work, please refer to the below documentation. The PoshSec Framework or PSF is a graphical front end utility for running PowerShell scripts, modules, and cmdlets. The PSF exposes parts of it's interface to PowerShell within the individualized...

CVE-2026-23751-poc

CVE-2026-23751-PoC Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture. CVE-2026-23751 Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET...

ExploitDotNetDCOM

ExploitDotNetDCOM c James Forshaw 2014 A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET. For information purposes only. All code is licensed under GPLv3...

Evtx_Log_Browser

Evtx Log xml Browser Browse through Windows evtx event logs & export to xml Latest version ishere Dependencies: .NET Framework 4.8 Powershell Version: 5.1...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

net/http: Sensitive headers not cleared on cross-origin redirect in net/http

A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...