veilgate

VeilGate VeilGate is an open-source deception proxy for teams that want to raise the cost of automated security probing without putting fragile block rules in front of real users. It sits in front of a web application, scores each request, and chooses one of three outcomes: Real : forward clean...

PoW-Shield

Description PoW Shield provides DDoS protection on OSI application layer by acting as a proxy that utilizes proof of work between the backend service and the end user. This project aims to provide an alternative to general anti-DDoS methods such as Google's ReCaptcha that has always been a pain t...

anubis-fetch

anubis-fetch root@kitploit: $ nix run github:fzakaria/anubis-fetch -- https://lore.kernel.org/linux-mm/some-thread/T/ 一个快速（Go）CLI 工具，用于从 Anubis 工作量证明墙和 Cloudflare 指纹检测之后获取 URL — 在进程内解决挑战，仅在必要时才启动真实浏览器。 越来越多的网站 — lore.kernel.org、GNOME、kernel.org 等等 — 都位于 Anubis 这个机器人防护墙之后。它会要求你的浏览器在提供任何内容之前先解决一个...

Azure-APIM-Dev-Portal-Signup-Bypass

一个用于绕过 Azure API Management APIM 中已禁用开发者门户注册的概念验证脚本，通过直接调用后端注册 API 实现。 功能说明 Azure APIM 开发者门户可以配置为通过门户 UI 禁用自助注册。在某些部署中，即使 UI 按钮被隐藏或移除，底层 API 端点（/signup）仍然保持活动并可达。该脚本利用了这一差距，通过以下方式： 1. 从 /v2/captcha-challenge 获取工作量证明（PoW）验证码挑战 2. 在客户端暴力破解 SHA-256 PoW 解决方案 3. 使用已解决的挑战和账户详情直接向 /signup 提交注册请求 所有输入（目标...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48082

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082

OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

PYSEC-2026-1115 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Impact A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modifi...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-9.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-8.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-7.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

cap-exploit-poc

cap-exploit-poc This repository contai...

SDN-SYN PoW: Intent-Aware Adaptive SDN Defense with PoW against Multi-Domain SYN Floods

The stability of Internet services is persistently challenged by the escalating scale of volumetric TCP SYN floods, as conventional defenses like SYN Cookies fail by exacerbating bandwidth depletion under modern attacks. This paper introduces SDN-SYN PoW, a novel defense architecture that...

NGCaptcha: A CAPTCHA Bridging the past and the Future

CAPTCHAs are widely employed for distinguishing humans from automated bots online. However, current vision based CAPTCHAs face escalating security risks: traditional attacks continue to bypass many deployed CAPTCHA schemes, and recent breakthroughs in AI, particularly large scale vision models,...

GO-2025-4239 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go...

CVE-2025-68113

CVE-2025-68113 (ALTCHA) describes a cryptographic semantic binding flaw in ALTCHA libraries where the HMAC does not unambiguously bind challenge parameters to the nonce, enabling potential replay of previously solved challenges depending on server-side handling. Affected components include ALTCHA...