singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

dref

DNS Rebinding Exploitation Framework This project is no longer maintained. dref does the heavy-lifting for DNS rebinding. The following snippet from one of its built-in payloads shows the framework being used to scan a local subnet from a hooked browser; after identifying live web services it...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — Same-Origin Policy bypass via cross-port interception CVE-2026-20643...

flash-xdomain-xploit

Autor: Gursev Singh Kalra [email protected] Evadiendo la Same Origin Policy con Flash y un crossdomain.xml inseguro Compilación y despliegue del código ActionScript de prueba de concepto 1. Descargue e instale el SDK de Apache Flex. Incluye un compilador de ActionScript. 2. Copie el código...

flash-xdomain-xploit

Autor: Gursev Singh Kalra [email protected] Evadiendo la política de mismo origen con Flash y crossdomain.xml inseguro Compilando e implementando el código ActionScript de prueba de concepto 1. Descargue e instale Apache Flex SDK. Viene con un compilador de ActionScript. 2. Copie el código...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

whonow

Whonow DNS 服务器 一个恶意的 DNS 服务器，用于动态执行 DNS 重新绑定攻击。whonow 让你能够 通过域名请求本身 动态指定 DNS 响应和重新绑定规则。 root@kitploit: 首次查询该域名时响应 34.192.228.43，之后每次都响应 192.168.1.1 A.34.192.228.43.1time.192.168.1.1.forever.rebind.network 首次响应 34.192.228.43，接下来五次响应 192.168.1.1，然后重新开始（1次，5次，循环往复...）...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss

CVE-2026-78997 — UC Browser para Android Universal XSS UXSS Material PoC para CVE-2026-78997 — Universal Cross-Site Scripting en UC Browser para Android com.UCMobile.intl, versión 13.7.8.1314, divulgado por Omri Inbar Novee. Un XSS reflejado en el dominio incluido en la lista blanca del puente...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...

CVE-2026-43735

CVE-2026-43735 WebKit cross-origin information leak. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principle When the parent page uses to trigger a fragment navigation of a cross-origin iframe, the NavigateEvent.sourceElement received by the iframe is the element of the parent page...

CVE-2017-17692

CVE-2017-17692 Exploit Title: SOP Bypass Date: 06 Septmber 2017 Software Link: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ Category: Browser Video PoC:...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been addressed through improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4. Processing maliciously crafted web content may bypass the Same Origin Policy...

Astra Linux – Vulnerability in Firefox

Bypass of the same-origin policy in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to bypass the same-origin policy via malicious network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox

Bypass of same-origin policy in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...

Astra Linux – Vulnerability in Firefox and Thunderbird

Bypass of the same-origin policy in the Graphics:Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in the Input component in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...