keypair

keypair Genera una coppia di chiavi RSA PEM in puro JS Utilizzo root@kitploit: var keypair = require'keypair'; var pair = keypair; console.logpair; restituisce root@kitploit: $ node example.js public: '-----BEGIN RSA PUBLIC...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

ROCA-attack-on-vulnerability-CVE-2017-15361

ROCA-attack-on-vulnerability-CVE-2017-15361 Questa repository contiene la tesi sviluppata per la mia laurea triennale in Ingegneria Matematica al Politecnico di Torino. È uno script basato su Python e Sage. L'obiettivo dello script è generare una chiave RSA, valutarne la vulnerabilità all'attacco...

openssl

Welcome to the OpenSSL Project OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations are based on a full-strength general purpose cryptographic library, which...

rocacheck

rocacheck Package rocacheck ist eine Go-Implementierung des Schlüssel-Fingerabdruck-Algorithmus, der prüft, ob ein RSA-Schlüssel von defektem Infineon-Code erzeugt wurde und anfällig für die Faktorisierung durch die Return of Coppersmith's Attack ROCA / CVE-2017-15361 ist...

heartbleed-tools

Scanner di vulnerabilità Heartbleed CVE-2014-0160 di OpenSSL, data miner e strumenti di ripristino chiavi RSA. Autore: Einar Otto Stangvik / @einaros / https://hacking.ventures Dato che il gatto è ormai fuori dal sacco da tempo e altri hanno iniziato a pubblicare i loro strumenti, metto anche i...

Detect-CVE-2017-15361-TPM

Erkennen von Trusted Platform Modules, die für CVE-2017-15361 anfällig sind Dieses Repository enthält Inhalte, die DoD-Administratoren dabei unterstützen, Systeme mit einem aktivierten Trusted Platform Module TPM zu erkennen, das für CVE-2017-15361 anfällig ist, und ist eine Ergänzung zur...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - PoC di Bypass dell'Autenticazione in pac4j-jwt Nota: Questo non è un mio lavoro originale. Lo conservo qui come riferimento. Metodologia di lavoro: root@kitploit: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admi...

tp-link-decrypt

HINWEIS: Mit Stand vom 5. Oktober 2025 ist dieses Projekt nun veraltet. Nate Robbins hat freundlicherweise die Weiterführung übernommen und Switch-Entschlüsselung hinzugefügt - https://github.com/robbins/tp-link-decrypt...

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

CVE-2026-0073

ADB TLS-Authentifizierungsumgehungs-Exploit CVE-2026-0073 Ein automatisierter Netzwerkscanner und Exploitationstool für CVE-2026-0073 , eine Schwachstelle im Android Debug Bridge-Daemon adbd, die unauthorisierte Remote-Codeausführung RCE und interaktiven Shell-Zugriff über Wireless Debugging...

jwt-spoof-tool

jwt-spoof-tool Tool Beschreibung : Ich habe dieses Tool zu Lernzwecken und zur Automatisierung des JWT-Token-Hijackings erstellt, ohne auf BurpSuite angewiesen zu sein. Der Code ist gut dokumentiert und leicht nachvollziehbar. Basierend auf CVE-2018-0114 Die Sicherheitslücke entsteht, weil der...

CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-78417

Devolutions Remote Desktop Manager versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier, contain a vulnerability in the IronVNC client due to insufficient verification of data authenticity . During RSA-AES authentication , the client automatically accepts the server's RSA key without pro...

EUVD-2026-65063

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-78417

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...

Astra Linux – Vulnerability in Thunderbird, Firefox

When importing an SPKI RSA public key as an ECDSA P-256 key, the key is handled incorrectly, causing the tab to crash. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

EulerOS 2.0 SP13 : python-paramiko (EulerOS-SA-2026-3041)

According to the versions of the python-paramiko packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-44405 Tenable has extracted the preceding...