PoW-Shield

描述 PoW Shield 通过充当代理服务器，在后端服务和最终用户之间利用工作量证明，为 OSI 应用层提供 DDoS 防护。该项目旨在为 Google 的 ReCaptcha 等常见反 DDoS 方法提供一种替代方案，这些方法往往令人困扰。访问受 PoW Shield 保护的网络服务从未如此简单：只需访问 URL，您的浏览器将自动为您完成其余验证。 PoW Shield 旨在通过单个 Web 应用 / Docker 镜像提供以下服务： 工作量证明认证 速率限制和 IP 黑名单 Web 应用防火墙 （新版）领英上的文章 在 Pentester Academy TV 上展示 Medium...

anubis-fetch

anubis-fetch root@kitploit: $ nix run github:fzakaria/anubis-fetch -- https://lore.kernel.org/linux-mm/some-thread/T/ Una CLI rápida en Go para obtener URLs desde detrás de muros de prueba de trabajo de Anubis y comprobaciones de huella digital de Cloudflare — resolviendo el desafío en el propio...

veilgate

VeilGate VeilGate es un proxy de engaño de código abierto para equipos que quieren aumentar el coste del escaneo de seguridad automatizado sin poner reglas de bloqueo frágiles delante de los usuarios reales. Se sitúa delante de una aplicación web, puntúa cada solicitud y elige uno de tres...

Azure-APIM-Dev-Portal-Signup-Bypass

一个用于绕过 Azure API Management APIM 中已禁用开发者门户注册的概念验证脚本，通过直接调用后端注册 API 实现。 功能说明 Azure APIM 开发者门户可以配置为通过门户 UI 禁用自助注册。在某些部署中，即使 UI 按钮被隐藏或移除，底层 API 端点（/signup）仍然保持活动并可达。该脚本利用了这一差距，通过以下方式： 1. 从 /v2/captcha-challenge 获取工作量证明（PoW）验证码挑战 2. 在客户端暴力破解 SHA-256 PoW 解决方案 3. 使用已解决的挑战和账户详情直接向 /signup 提交注册请求 所有输入（目标...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48082

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082

OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

PYSEC-2026-1115 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Impact A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modifi...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-9.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-8.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-7.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

cap-exploit-poc

cap-exploit-poc This repository contai...

SDN-SYN PoW: Intent-Aware Adaptive SDN Defense with PoW against Multi-Domain SYN Floods

The stability of Internet services is persistently challenged by the escalating scale of volumetric TCP SYN floods, as conventional defenses like SYN Cookies fail by exacerbating bandwidth depletion under modern attacks. This paper introduces SDN-SYN PoW, a novel defense architecture that...

NGCaptcha: A CAPTCHA Bridging the past and the Future

CAPTCHAs are widely employed for distinguishing humans from automated bots online. However, current vision based CAPTCHAs face escalating security risks: traditional attacks continue to bypass many deployed CAPTCHA schemes, and recent breakthroughs in AI, particularly large scale vision models,...

GO-2025-4239 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go...

CVE-2025-68113

CVE-2025-68113 (ALTCHA) describes a cryptographic semantic binding flaw in ALTCHA libraries where the HMAC does not unambiguously bind challenge parameters to the nonce, enabling potential replay of previously solved challenges depending on server-side handling. Affected components include ALTCHA...