PoW-Shield

描述 PoW Shield 通过充当代理服务器，在后端服务和最终用户之间利用工作量证明，为 OSI 应用层提供 DDoS 防护。该项目旨在为 Google 的 ReCaptcha 等常见反 DDoS 方法提供一种替代方案，这些方法往往令人困扰。访问受 PoW Shield 保护的网络服务从未如此简单：只需访问 URL，您的浏览器将自动为您完成其余验证。 PoW Shield 旨在通过单个 Web 应用 / Docker 镜像提供以下服务： 工作量证明认证 速率限制和 IP 黑名单 Web 应用防火墙 （新版）领英上的文章 在 Pentester Academy TV 上展示 Medium...

anubis-fetch

anubis-fetch $ nix run github:fzakaria/anubis-fetch -- --text https://lore.kernel.org/ 一个 Go CLI，用于获取位于 Anubis 工作量证明挑战之后的 URL。它在进程内解决旧版 SHA-256 和 WASM 挑战，并以无头 Chromium 作为回退方案。 诸如 lore.kernel.org 和 kernel.org 之类的站点使用 Anubis 要求在提供页面之前完成工作量证明。普通的 HTTP 客户端可能会收到挑战页面，而不是所请求的内容。anubis-fetch...

veilgate

VeilGate VeilGate 是一个开源欺骗代理，适用于希望通过提高自动安全探测成本而不在真实用户面前设置脆弱阻断规则的团队。 它位于 Web 应用之前，对每个请求进行评分，并选择三种结果之一： Real ：将干净流量转发到上游应用。 Challenge ：要求可疑但模棱两可的客户端解决浏览器工作量证明。 Tarpit ：将高置信度代理流量分流到确定性虚假应用。 目标不是魔法般的不可攻破。目标是更好的经济学：让人类和正常自动化流畅运行，同时让 AI 辅助的扫描器将时间、代币和注意力浪费在可信的死胡同里。 功能 反向代理，支持 observe、challenge、tarpit...

Azure-APIM-Dev-Portal-Signup-Bypass

一个用于绕过 Azure API Management APIM 中已禁用开发者门户注册的概念验证脚本，通过直接调用后端注册 API 实现。 功能说明 Azure APIM 开发者门户可以配置为通过门户 UI 禁用自助注册。在某些部署中，即使 UI 按钮被隐藏或移除，底层 API 端点（/signup）仍然保持活动并可达。该脚本利用了这一差距，通过以下方式： 1. 从 /v2/captcha-challenge 获取工作量证明（PoW）验证码挑战 2. 在客户端暴力破解 SHA-256 PoW 解决方案 3. 使用已解决的挑战和账户详情直接向 /signup 提交注册请求 所有输入（目标...

CVE-2026-104424

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...

CVE-2026-104424 Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...

CVE-2026-104424

Zebra versions prior to 6.1.0 are vulnerable to an incorrect calculation in the ZIP-317 block template selector . The flaw stems from omitting the header and transaction-count size from the block budget. An attacker can exploit this by placing valid selectable transactions into a victim miner's m...

CVE-2026-104424 Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...

EUVD-2026-91435

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...

PT-2026-104235

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 6.1.0 Description An incorrect calculation in the ZIP-317 block template selector fails to account for the header and transaction-count size within the block budget. This allows attackers to submit valid selectable...

CVE-2026-104424: Incorrect Calculation of Buffer Size

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...

PDoS: A Profitable Denial-Of-Service Attack against Proof-Of-Work Blockchain Liveness

The security and liveness of Proof-of-Work PoW blockchains fundamentally depend on the economic rationality of miners. Existing incentive-driven denial-of-service attacks, such as BDoS, can deter rational miners from participating, but require the attacker to continuously absorb substantial...

CVE-2026-48082

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48082

OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...

EUVD-2026-54155

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...