dbd

d8888b. d8888b. d8888b. 88 8D 88 8D 88 8D 88 88 88oooY' 88 88 88 88 88b. 88 88 88 .8D 88 8D 88 .8D Y8888D' Y8888P' Y8888D' Durandal's Backdoor Copyright C 2013 Kyle Barnthouse [email protected] dbd は GNU GPL のもとで配布されています Mipsbe バイナリは Darkerego によって追加されました https://github.com/darkerego...

pmkidcracker

PMKID WPA2 Cracker This program is a tool written in Python to recover the pre-shared key of a WPA2 WiFi network without any de-authentication or requiring any clients to be on the network. It targets the weakness of certain access points advertising the PMKID value in EAPOL message 1. Program...

IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

ios_Restriction_PassCode_Crack---Python-version

ios 접근 제한 암호 크랙 -Python 버전 개요 ios Restriction PassCode Cracker - 이 버전의 애플리케이션은 Python 프로그래밍 언어로 작성되었으며, iphone/ipad의 접근 제한 암호Restriction PassCode를 크랙하는 데 사용됩니다. iphone/ipad 접근 제한 암호 크랙 방법C 버전과 동일 무차별 대입 크랙brute-force crack 1 .컴퓨터에 있는 백업 파일에서 Base64 키와 salt를 가져옵니다. 2 .Base64 키와 salt를 디코딩합니다. 3...

collisions

ハッシュ衝突と悪用 作者: Ange Albertini と Marc Stevens. FAQ TL;DR Q: ファイルに任意のMD2/MD4/MD5/MD6/SHA1/SHA2/SHA3、または別のファイルと同じハッシュを付与することは可能ですか？ A: いいえ。 Q: 同じハッシュを持つ2つの異なるファイルを作成できますか？ A: MD5なら、標準的なコンピュータで数秒です。SHA1なら、可能ですが、エンドユーザーには現実的ではありません（計算量: 2^61.2 コスト: $11k）。 Q: データを追加することで、2つの異なるファイルに同じハッシュを持たせられますか？ A:...

PwnedPasswordsChecker

PwnedPasswordsChecker PwnedPasswordsChecker 는 알려진 비밀번호의 해시SHA1 또는 NTLM 형식가 I Have Been Pwned 유출 목록에 있는지와 그 발생 횟수를 확인하는 도구입니다. SHA1용 해시 인코딩 버전은 여기에서, NTLM용 해시 인코딩 버전은 여기에서 다운로드할 수 있습니다. 목록을 다운로드한 후에는 내 다른 도구 HIBP PasswordList Slimmer를 사용하여 이진 형식으로 변환해야 합니다. 이 스크립트는 해시별로 정렬된 HIBP 버전에서만 작동하며, 항목 해시는...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 認証バイパス PoC CVE-2026-15013 の概念実証（PoC）: miniOrange 製 WordPress プラグイン SAML Single Sign On – SSO Login （バージョン 5.4.3 以下 ）における、SAML の 署名アルゴリズム混同 （HMAC-SHA1）を利用した未認証の認証バイパス。 許可されたテストのみ。 このコードは、自分が所有するシステム、または明示的な許可を得たシステムに対してのみ使用してください。コンピュータシステムへの不正アクセスは違法です...

CVE-2026-58200

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200

@jhb.software/payload-cloudinary-plugin (Payload CMS Cloudinary storage adapter), versions 0.3.0 through 0.4.0 , is affected by an Improper Verification of Cryptographic Signature (CWE-347) when clientUploads: true is enabled. The POST /api/cloudinary-generate-signature endpoint in cloudinary/src...

CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

EUVD-2026-78825

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200: Improper Verification of Cryptographic Signature

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ima: Fixed a potential memory leak in imainitcrypto. If the SHA1 template is unable to be allocated, IMA fails to initialize and exits without freeing the imaalgoarray. Adding the necessary kfree call for imaalgoarray will preven...

CVE-2026-87929

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-87929

MaxSite CMS through version 109.6 contains a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Because the key is publicly known, an unauthenticated attacker can compute an HMAC-SHA1 signature to mint a malicious ci_session cookie with ad...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...