exploit-cve-2017-5715

Spectre attack Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications...

CVE-2026-42527

Permissive Default ObjectInputFilter — DNS Side-Channel Reproducer CVE-2026-42527 This project demonstrates CVE-2026-42527 in Apache Camel. The default ObjectInputFilter pattern that several Camel components ship for defense-in-depth deserialization filtering — java.;javax.;org.apache.camel.;! —...

phywhispererusb

PhyWhisperer-USB What is this thing? This is a hardware trigger for FI or SCA, which triggers on the USB phy. Be sure to read the documentation at http://phywhispererusb.readthedocs.io/ as well! If you are getting started, there are a few demonstration notebooks showing how to: Sniff Data Stream...

CVE-2020-16012-PoC

CVE-2020-16012 | Side Channel Attack This repository contains Proofs of Concept PoCs for CVE-2020-16012 , a side-channel vulnerability identified in the implementation of CanvasRenderingContext2D.drawImage in Firefox and Chromium. This project was conducted as a collaborative effort by a team of...

loupe

Loupe Loupe is an iOS and iPadOS app that gives you a hands-on tour of the device fingerprinting surface. It reads real values from public iOS APIs, the same ones any third-party app can call, and shows them to you raw. The point is simple: see what your iPhone quietly exposes, and why each readi...

spectre-attack-demo

Spectre Attack Example Example of using revealed "Spectre" exploit from 2 Jan 2018 CVE-2017-5753 and CVE-2017-5715 Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the...

sgx-step

A Practical Attack Framework for Precise Enclave Execution Control SGX-Step is an open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX platforms in particular. SGX-Step consists of an adversarial Linux kernel driver and a small user-spa...

power_analysis

Power analysis attack over RSA Index Index Introduction Power Analysis Attacks RSA: A Short Introduction RSA Example Equipment Measuring Power: A Short Introduction Ohm's Law Kirchhoff's Voltage Law KVL Voltage Divider Shunt Resistor Example Power Measurement Fast Exponentiation Fast Exponentiati...

scared

SCAred scared is a side-channel analysis framework maintained by eShard team. Getting started Requirements Scared need python 3.11 , 3.12 or 3.13 and Numpy =2 You can install scared, depending on your setup: from source with pip with conda Install with conda You just have to run: conda install -c...

pown

Pown Pown.js is a security testing and exploitation toolkit built on top of Node.js and NPM. Unlike traditional security tools, notably Metasploits, Pown.js considers frameworks to be an anti-pattern. Therefore, each feature in Pown is in fact a standalone NPM module allowing greater degree of...

SPOILER

SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk Gulmezoglu and Thomas Eisenbarth and Berk...

react2shell-evolved

React2Shell Scanner High Fidelity Detection for RSC/Next.js RCE Scanner for detecting Remote Code Execution RCE vulnerabilities in React Server Components and Next.js applications. About React2Shell Scanner is a specialized tool for identifying Remote Code Execution RCE vulnerabilities in...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

XFLTReaT

XFLTReaT This is just one thing of many things that was missing from the Internet. If you got tired of trying several tunnelling tools for each protocols, this must be your tool ^W framework. If you are interested in the details, please read the Wiki. Available modules TCP UDP ICMP SOCKS v4, 4a, ...

lvi-lfb-attack-poc

PoC for the LVI-LFB Control Flow Hijacking attack CVE-2020-0551 This repository holds the sources for the LVI-LFB Control Flow Hijacking attack PoC. Contents lvi-cfh-poc - hijack the control flow of another process via line-fill buffer spraying whitepaper Prerequisites 1. Visual Studio 2015 2. A...

etherify

Etherify - bringing the ether back to ethernet c 2020 Jacek Lipkowski SQ5BPF [email protected] 2020 RC3 Conference talk: https://www.youtube.com/watch?v=7ek994-fwNE Etherify 1 and 2: https://lipkowski.com/etherify with RPI 4 Etherify 3: https://lipkowski.com/etherify3/ with no ethernet cable...

mmiotic

mmiotic An exploratory tool for MMIO timing — time any physical address, and dissect the hardware off the latency. Unexpectedly useful for hardware reverse-engineering, hypervisor fingerprinting, side-channelling device activity, register characterization, calibrating malicious triggers, and...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Combined Covert Channel: CVE-2023-1206 + CVE-2024-49882 Overview This project demonstrates a covert communication channel using two Linux kernel vulnerabilities: Component| CVE| Purpose ---|---|--- Sync Channel| CVE-2023-1206| Clock synchronization via IPv6 hash collision timing Data Channel|...

cdf

CDF – crypto differential fuzzing CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approa...

Jump-over-ASLR-BTB

Branch Predictors & ASLR Author: Byte Reaper Description This repository contains research C implementation that demonstrates concepts related to branch predictors, speculative execution, and cache-based side channels in the context of address space layout randomization ASLR. Requirements : Linux...