6155 matches found
singularity
Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...
PHP-CGI-INTERNAL-RCE
PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...
whonow
Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...
whonow
Whonow DNS 服务器 一个恶意的 DNS 服务器，用于动态执行 DNS 重新绑定攻击。whonow 让你能够 通过域名请求本身 动态指定 DNS 响应和重新绑定规则。 root@kitploit: 首次查询该域名时响应 34.192.228.43，之后每次都响应 192.168.1.1 A.34.192.228.43.1time.192.168.1.1.forever.rebind.network 首次响应 34.192.228.43，接下来五次响应 192.168.1.1，然后重新开始（1次，5次，循环往复...）...
dref
DNS Rebinding Exploitation Framework This project is no longer maintained. dref does the heavy-lifting for DNS rebinding. The following snippet from one of its built-in payloads shows the framework being used to scan a local subnet from a hooked browser; after identifying live web services it...
CVE-2017-17692
CVE-2017-17692 Titolo Exploit: SOP Bypass Data: 06 settembre 2017 Link Software: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Autore Exploit: Dhiraj Mishra Contatto: http://twitter.com/mishradhiraj Sito Web: http://datarift.blogspot.in/ Categoria: Browser Video...
WebKit-NavigationAPI-SOP-Bypass
WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — bypass della Same-Origin Policy tramite intercettazione cross-port CVE-2026-20643...
flash-xdomain-xploit
Autore: Gursev Singh Kalra [email protected] Bypass della Same Origin Policy con Flash e crossdomain.xml insicuro Compilazione e distribuzione del codice ActionScript Proof of Concept 1. Scaricare e installare l'Apache Flex SDK. Include un compilatore ActionScript. 2. Copiare il codice...
flash-xdomain-xploit
Autor: Gursev Singh Kalra [email protected] Umgehung der Same-Origin-Policy mit Flash und unsicherer crossdomain.xml Kompilieren und Bereitstellen des Proof-of-Concept-ActionScript-Codes 1. Laden Sie das Apache Flex SDK herunter und installieren Sie es. Es enthält einen ActionScript-Compiler...
CVE-2026-43735
CVE-2026-43735 WebKit divulgazione di informazioni cross-origin. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principio Quando la pagina padre utilizza per attivare la navigazione di frammento di un iframe cross-origin, l'iframe riceve NavigateEvent.sourceElement che è l'elemento...
webrtc-ips
STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...
firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...
Astra Linux - Vulnerability in webkit2gtk
This issue was addressed through improved state management. This issue has been fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4. Processing maliciously crafted web content may bypass the Same-Origin Policy...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation of WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Network section of Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in the Input component in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...