certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

Pixnapping-Attack-on-Android

This article examines the evolution of security threats in the cryptocurrency storage space, focusing on modern methods for compromising private keys and seed phrases, which secure digital wallets. The modern cryptocurrency ecosystem faces a growing threat of cyberattacks aimed at compromising...

SSH-Stealer

RunAs-Stealer Smart keylogging capability to steal SSH Credentials including password & Private Key Usage The stolen credentials are written to C:\Users\Desktop\desktop.ini ADS log stream. To get the credentials type the cmd command: more \Desktop\desktop.ini:log" To remove the stored credentials...

walletool

walletool a tool for reading wallet.dat files A utility for extracting cryptocurrency wallet data from wallet.dat files. To set up the software on Windows or macOS, Windows and Linux require these instructions; macOS users get a simple DMG file. Verify that Git and Python are set up on Windows...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program mallory -config path/to/config.jso...

ecdsa-private-key-recovery

ecdsa-key-recovery Perform ECDSA and DSA Nonce Reuse private key recovery attacks A cryptographic research tool for analyzing signature vulnerabilities Let's recover the private-key for two signatures sharing the same nonce k. Note how choosing the same nonce k results in both signatures having a...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Ledger Monero App Spend key Extraction PoC repository for article: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

Phoenix-Rowhammer-Attack-CVE-2025-6202

This article examines the systemic cryptographic security threats posed by the Phoenix Rowhammer attack CVE-2025-6202, which can extract private keys from DDR5 RAM through hardware-level bit manipulation. In recent years, the dynamic development of cryptocurrency technologies has led to an...

CVE-2026-8932-PoC

CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...

SSH-Private-Key-Looting-Wordlists

LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH Private Key Looting Wordlists 🔒🗝️ This repository contains a collection of wordlists to aid in locating or brute-forcing SSH private key file...

RsaCtfTool

RsaCtfTool RSA multi-attack tool that decrypts data from weak public keys and recovers private keys. Overview This tool is a utility designed to decrypt data from weak public keys and attempt to recover the corresponding private key. It offers a comprehensive range of attack options for cracking...

driftwood

Driftwood ⚠️ The Driftwood CLI tool is no longer supported. Please use TruffleHog instead! ⚠️ Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. Driftwood performs lookups with the computed public key, so the...

CVE-2026-79551-Tenda

CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...

CVE-2023-33242

CVE-2023-33242 CVE-2023-33242 PoC The simulated Lindell17 protocol is vulnerable to a bit extraction exploit, allowing an attacker to recover the private key by iteratively extracting individual bits of the key. The protocol is designed to generate ECDSA signatures in a client-server model, with...

CVE-2014-2734

CVE-2014-2734 Ruby OpenSSL CA Private Key Spoofing ============= Ruby openssl has a vulnerability when a public key is a issued prior writing to private key and is reopened during a script it spoofs a CA private key. PoC script https://gist.github.com/10446549 Mitre:...

CVE-2024-24919

Intro Simple POC Python script that check & leverage Check Point CVE-2024-24919 vulnerability Wrong Check Point; vulnerable to arbitrary file reading. Requirements Python 3 Pip Required Library/Module Install via PIP requests urllib3 tqdm How To Run PS C:\ python CVE-2024-24919.py list.txt...

RAMnesia-Attack

This research presents a comprehensive analysis of two critical classes of attacks on the hardware memory of modern computer systems using DDR5 memory: Phoenix Rowhammer Attack CVE-2025-6202 and RAMnesia Attack CVE-2023-39910 . Both attacks demonstrate fundamental vulnerabilities in the processin...

ForgeCert

ForgeCert ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was...

curveball

curveball CVE-2020-0601 curveball - Alternative Key Calculator Build Windows Visual Studio 2012 or , then build the solution. Linux / Unix cc altkey.c -lcrypto -o altkey Usage Usage: altkey ecpubliccertificate.pem ecnewprivatekey.pem Example C:\security\curveball\Releasealtkey...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – ECDSA Nonce Reuse in IoT Firmware Signing Program Code Python ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with same nonce due to...