singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

dref

DNS Rebinding Exploitation Framework This project is no longer maintained. dref does the heavy-lifting for DNS rebinding. The following snippet from one of its built-in payloads shows the framework being used to scan a local subnet from a hooked browser; after identifying live web services it...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — 교차 포트 가로채기를 통한 동일 출처 정책 우회 CVE-2026-20643 | ---|--- CVE| CVE-2026-20643 발견자| Thomas Espach WebKit Bugzilla 306050 구성 요소| WebKit — WebCore::Navigation::innerDispatchNavigateEvent 영향| iOS 26.3.1 build 23D8133 iPhone18,2 분류| SOP 우회 상호작용| 클릭 / 링...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1...

whonow

Whonow DNS 서버 DNS 리바인딩 공격을 실행하기 위한 악성 DNS 서버입니다. whonow를 사용하면 도메인 요청 자체를 통해 DNS 응답 및 리바인드 규칙을 동적으로 지정할 수 있습니다. respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1.1 every time after that A.34.192.228.43.1time.192.168.1.1.forever.rebind.netwo...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

CVE-2026-43735

CVE-2026-43735 WebKit cross-origin information leak. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principle When the parent page uses to trigger a fragment navigation of a cross-origin iframe, the NavigateEvent.sourceElement received by the iframe is the element of the parent page...

CVE-2017-17692

CVE-2017-17692 취약점 제목: SOP 우회 날짜: 2017년 9월 6일 소프트웨어 링크: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en 익스플로잇 작성자: Dhiraj Mishra 연락처: http://twitter.com/mishradhiraj 웹사이트: http://datarift.blogspot.in/ 카테고리: 브라우저 PoC 동영상: https://youtu.be/x8f-tQaZriQ 데모...

flash-xdomain-xploit

저자: Gursev Singh Kalra [email protected] Flash와 안전하지 않은 crossdomain.xml을 이용한 Same Origin Policy 우회 개념 증명PoC ActionScript 코드 컴파일 및 배포 1. Apache Flex SDK를 다운로드하여 설치합니다. 여기에는 ActionScript 컴파일러가 포함되어 있습니다. 2. ActionScript 코드를 로컬 디렉터리에 복사하고 XDomainXploit.as로 이름을 지정합니다. 3. readFrom 및 sendTo 매개변수의 ...

flash-xdomain-xploit

저자: Gursev Singh Kalra [email protected] Flash와 안전하지 않은 crossdomain.xml을 이용한 동일 출처 정책 우회 Proof of Concept ActionScript 코드 컴파일 및 배포 1. Apache Flex SDK를 다운로드하여 설치합니다. 여기에는 ActionScript 컴파일러가 포함되어 있습니다. 2. ActionScript 코드를 로컬 디렉터리에 복사하고 XDomainXploit.as로 이름을 지정합니다. 3. readFrom 및 sendTo 매개변수의 값을...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC 브라우저 for Android 범용 XSS UXSS CVE-2026-78997 에 대한 PoC 자료 — UC 브라우저 for Android com.UCMobile.intl, 버전 13.7.8.1314의 범용 크로스 사이트 스크립팅Universal Cross-Site Scripting, Omri Inbar Novee에 의해 공개됨. 브리지 화이트리스트에 등록된 도메인 mtmsg.uc.cn에서의 반사형 XSS는 권한이 있는 ucapi JavaScript 브리지에 대한 접근을 허용한다...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14844)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514844 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape du...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_14640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514640 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_9692)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20269692 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43213 webkitgtk: Processing maliciously crafted web...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2025_21280)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521280 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_14442)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514442 advisory. firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component CVE-2025-9182 thunderbird: firefox: Sandbox escape due t...

Rocky Linux 10.1 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_21281)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521281 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

Rocky Linux 10.1 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_21843)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521843 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefox:...

Linux Distros Unpatched Vulnerability : CVE-2026-102329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...

Rocky Linux 10.1 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2025_23035)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523035 advisory. firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 CVE-2025-14333 firefox: Use-after-free i...