linux-fingerprint-r503

linux-fingerprint-r503 — inicio de sesión con huella digital para Linux usando un Grow R503 + Arduino Un lector USB de huellas dactilares para escritorios Linux construido a partir de componentes. Coste total de las piezas inferior a 15 $. Sustituto directo del fprintd oficial: PAM, Ajustes de KD...

CVE-2026-0101-BLE-Address-Spoofing-via-Weak-Resolvable-Private-Address

CVE-2026-0101 – 通过弱可解析私有地址实现 BLE 地址欺骗 程序代码（使用 bleak 模拟的 Python） root@kitploit: bleperipheralsim.py - Simulated BLE peripheral with weak RPA verification import asyncio, random, hashlib from bleak import BleakServer, BleakScanner Simplified - we'll use a basic socket to simulate BLE bonding Store...

ams-failopen

AppleMediaServices 中的失效开放签名（零日披露） 概述 此问题构成了一个现有的零日漏洞，反映了 AppleMediaServices.framework 中的系统性设计缺陷，而非回归或特定版本的错误。 Apple 的 AppleMediaServices 框架中存在一个关键的失效开放缺陷：如果远程配置文件（"Bag"）加载失败，请求签名会被静默禁用。这影响 iOS、macOS、tvOS 和 watchOS。 当 Bag 无法检索（由于 DNS 操纵、超时或网络干扰）时，AppleMediaServices 守护进程会禁用 Mescal/Absinthe 签名，并向...

radio-hackbox

SySS Radio Hack Box SySS Radio Hack Box 是一个概念验证软件工具，用于演示无线键盘 Cherry B.Unlimited AES 的重放和按键注入漏洞。 要求 树莓派 树莓派 Radio Hack Box 扩展板（包含一块 LCD、一些 LED 和几个按钮） 刷写了 nrf-research-firmware（由 Bastille 威胁研究团队开发）的 nRF24LU1+ USB 无线电适配器，例如： Bitcraze CrazyRadio PA USB 适配器 Logitech Unifying 适配器（型号 C-U0007，基于 Nordic...

RFCrack

/ | | | / | | | | / \ ' - / \ / - | / \ V V / ' / \ || - /||// /| ///|. //, / / |/ | /| | | || | / | | '/ /| / / | || || , | \ root@kitploit: 欢迎使用 RFCrack — 一款软件定义无线电攻击工具 开发者：@Ficti0n - http://ConsoleCowboys.com CCLabs：http://cclabs.io 博客：console-cowboys.blogspot.com...

CVE-2022-27254

CVE-2022-27254 本田遥控无钥匙系统漏洞CVE-2022-27254的PoC 免责声明： 仅供教育目的。 请注意，此漏洞的发现者是 Ayyappan Rajesh，马萨诸塞大学达特茅斯分校的学生，以及 HackingIntoYourHeart。 本仓库中提及的其他人员均因所提供的支持而获得认可，但未在与本发现相关的任何研究中发挥积极作用。如果要在别处发布这些发现，请勿在未经明确批准的情况下将其与任何其他个人、公司或机构关联。 摘要： 这是 CVE-2022-27254...

ESP-RFID-Tool

ESP-RFID-Tool 作者：Corey Harding 官方网站： www.rfid-tool.com April Brother 目前正在生产该硬件，您可以直接从中国通过他们的渠道购买 官方商店：https://blog.aprbrother.com/product/esp-rfid-tool AliExpress 商店：https://www.aliexpress.com/item/ESP-RFID-Tool/32850151497.html Tindie 商店：https://www.tindie.com/products/aprbrother/esp-rfid-tool/...

nrf24-playset

nRF24 玩法集 nRF24 玩法集是一组软件工具，用于操作基于 Nordic Semiconductor nRF24 收发器（例如 nRF24LE1 和 nRF24LU1+）的无线输入设备，如键盘、鼠标和演示器。 所有软件工具均支持刷写了 nrf-research-firmware 的 USB 无线网卡（感谢 Bastille 威胁研究团队的 @marcnewlin）。 要求 刷写了 Bastille 威胁研究团队 nrf-research-firmware 的 nRF24LU1+ USB 无线网卡，例如： Bitcraze CrazyRadio PA USB 无线网卡 Logite...

CVE-2026-54155

node-opcua (NPM, versions ≤ 2.165.0) contains a missing nonce verification in the UserNameIdentityToken authentication handler (packages/node-opcua-server/source/opcua_server.ts). After RSA-OAEP decryption of the password blob, the server never checks that trailing bytes match session.nonce. This...

CVE-2026-54155 node-opcua: Missing nonce verification in UserNameIdentityToken authentication

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcuaserver.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session...

CVE-2022-38766

CVE-2022-38766 PoC para la vulnerabilidad en el sistema sin llave del Renault ZOE CVE-2022-38766 Introducción Companylogo AUTOCRYPT MalHyuk Resumen Esta vulnerabilidad planteó la cuestión de si los vehículos eléctricos ZOE están seguros frente a la piratería por RF. Por esta razón, el vehículo ZO...

CVE-2026-89177

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID

CVE-2026-23003 – 因缺失源链 ID 导致的跨链桥消息伪造 程序代码（Solidity + Python 漏洞利用） root@kitploit: // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from, address to, uint256 amount, uint256 chainId; function depositaddress to, uint256 amount,...

CVE-2026-89177

WeenyGenius is a computer lab management system by Howyar Technologies . The vulnerability stems from reliance on ZMTP Null mode , an unauthenticated zero-message-transport-protocol handshake that provides no encryption or integrity. An unauthenticated attacker on the same (adjacent) network can ...

EUVD-2026-76004

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

CVE-2026-89177 Howyar｜WeenyGenius - Use of Insecure Protocol

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-

CVE-2026-11117 – WPA2 四次握手密钥重装（KRACK 模拟） 程序代码（Python） root@kitploit: kracksim.py - Simulates reinstallation of an already-used PTK import hashlib, os class AccessPoint: def initself: self.anonce = os.urandom32 self.ptk = None def sendmsg3self, snonce: Normally would install PTK, but here we resen...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – VoIP SIP 摘要认证重放 程序代码（Python SIP 模拟器） root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set @app.route'/call', methods='POST' def...

CVE-2026-23004-Automotive-UDS-Authentication-Bypass-via-Replay-Attack

CVE-2026-23004 – 汽车UDS认证绕过（重放攻击） 程序代码（Python CAN‑UDS 模拟器） root@kitploit: udssim.py - ECU that authenticates with a simple challenge import random, hashlib class ECU: def initself: self.secret = b'longsecretkey' def generatechallengeself: self.challenge = random.randbytes8 return self.challenge de...

CVE-2026-23010-CCSDS-Telecommand-Replay-Without-Sequence-Number

CVE-2026-23010 – Replay de Telecomando CCSDS sin Número de Secuencia Código del Programa simulador de satélite en Python root@kitploit: satellitesim.py - Spacecraft that executes telecommands without checking sequence number class Satellite: def initself: self.executed = set def receivetcself,...