singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

dref

Фреймворк для эксплуатации DNS Rebinding Этот проект больше не поддерживается. dref берет на себя основную работу по DNS rebinding. Следующий фрагмент из одного из его встроенных полезных нагрузок показывает, как фреймворк используется для сканирования локальной подсети из взломанного браузера;...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — 교차 포트 가로채기를 통한 동일 출처 정책 우회 CVE-2026-20643...

flash-xdomain-xploit

저자: Gursev Singh Kalra [email protected] Flash와 안전하지 않은 crossdomain.xml을 이용한 Same Origin Policy 우회 개념 증명PoC ActionScript 코드 컴파일 및 배포 1. Apache Flex SDK를 다운로드하여 설치합니다. 여기에는 ActionScript 컴파일러가 포함되어 있습니다. 2. ActionScript 코드를 로컬 디렉터리에 복사하고 XDomainXploit.as로 이름을 지정합니다. 3. readFrom 및 sendTo 매개변수의 ...

flash-xdomain-xploit

저자: Gursev Singh Kalra [email protected] Flash와 안전하지 않은 crossdomain.xml을 이용한 동일 출처 정책 우회 Proof of Concept ActionScript 코드 컴파일 및 배포 1. Apache Flex SDK를 다운로드하여 설치합니다. 여기에는 ActionScript 컴파일러가 포함되어 있습니다. 2. ActionScript 코드를 로컬 디렉터리에 복사하고 XDomainXploit.as로 이름을 지정합니다. 3. readFrom 및 sendTo 매개변수의 값을...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

whonow

Whonow DNS-сервер Вредоносный DNS-сервер для выполнения атак DNS Rebinding на лету. whonow позволяет динамически задавать DNS-ответы и правила перепривязки с помощью самих запросов к доменам. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested a...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC 브라우저 for Android 범용 XSS UXSS CVE-2026-78997 에 대한 PoC 자료 — UC 브라우저 for Android com.UCMobile.intl, 버전 13.7.8.1314의 범용 크로스 사이트 스크립팅Universal Cross-Site Scripting, Omri Inbar Novee에 의해 공개됨. 브리지 화이트리스트에 등록된 도메인 mtmsg.uc.cn에서의 반사형 XSS는 권한이 있는 ucapi JavaScript 브리지에 대한 접근을 허용한다...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Эта PoC демонстрирует, как злоумышленник может объединить Orange Tsai's CVE-2024-4577 с DNS-ребндингом для достижения удаленного выполнения кода на внутренней сетевой инфраструктуре непосредственно через веб-браузер жертвы. Обходя Same-Origin Policy SOP и эксплуатируя уязвимы...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been addressed through improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4. Processing maliciously crafted web content may bypass the Same Origin Policy...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in the Input component in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Network section of Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Bypass of the same-origin policy in the Networking:Cookies component. This vulnerability has been fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in the Network component of Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...