InflativeLoading

InflativeLoading Article: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Major Update History In this section, major updates are provided. Major updates do include added supports or features. 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE...

BrokenPipe

BrokenPipe - Steam Client Service LPE Vulnerability This is the single-script version. The original compiled C++ PoC is on the legacy branch. Thanks to John Hammond for the suggestion, subscribe to him! PoC video: YouTube John Hammond's breakdown: YouTube Greetz to @MSNIGHTMARE2000 for the inspo ...

Detect-It-Easy

Detect It Easy DiE is a powerful tool for file type identification, popular among malware analysts , cybersecurity experts , and reverse engineers worldwide. Supporting both signature-based and heuristic analysis , DiE enables efficient file inspections across a broad range of platforms, includin...

micr0_shell

micr0 shell Micr0shell is a lightweight and efficient Python script designed for dynamically generating Windows X64 Position-Independent Code PIC Null-Free reverse shell shellcode. Depending on the options selected, the generated shellcode can be up to 27 bytes smaller than comparable shellcode...

CVE-2025-66478-kinda-waf

kinda-waf Simple, temporary WAF protection tester targeting a specific payload sequence. Let's help websites stay safe until they are properly patched! Purpose Protect from CVE-2025-66478 by detecting and blocking requests containing specific payload signatures. This shouldn't break legitimate...

CVE-2017-13156

Check-CVE-2017-13156.py root@ubuntu:/CVE-2017-13156$ pip install androguard root@ubuntu:/CVE-2017-13156$ python Check-CVE-2017-13156.py InsecureBankv2.apk Checking if InsecureBankv2.apk is vulnerable to CVE-2017-13156 vulnerability InsecureBankv2.apk md5: 5ee4829065640f9c936ac861d1650ffc...

signature-base

Signature-Base Signature-Base is the YARA signature and IOC database for our scanners LOKI and THOR Lite Focus of Signature-Base 1. High quality YARA rules and IOCs with minimal false positives 2. Clear structure 3. Consistent rule format Directory Structure iocs - Simple IOC files CSV yara - YAR...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-39001, QID-3783322 This Fix is intended for 64-bit Windows Computers This PowerShell code is one way to fix the vulnerability - aside from creating a .reg file and using reg import to import...

CVE-2024-52510

Nextcloud X-E2EE-SIGNATURE Bypass POC Summary During normal operation of Nextcloud's E2EEv2 protocol, clients cryptographically sign folder-metadata before uploading to the server. This ensures the metadata has not been tampered with when it is re-fetched for the purposes of file-sharing or synci...

Windows-SignedBinary

Generate Windows Signed Binary With a Different Hash The idea was to bypass endpoint solution that block known "malicious" signed application such as "regsvr32.exe". I wanted to find a way to get a valid signed file with a different hash. The Analysis Using signtool verify /v /a cmd.exe...

Digital-Signature-Forgery-Attack

In this article, we will look at the cryptographic attack of digital signature forgery Digital Signature Forgery Attack, its consequences pose a threat to the security of transactions in the Bitcoin network, since digital signatures confirm the ownership and authorization of cryptocurrency...

DetectPacket-CVE-2017-8464

Building a Vulnerability Detection Application for CVE-2017-8464 Source click here CONTENTS: PART 1: OVERVIEW OF CVE-2017-8464 1. CONCEPT OF LNK FILE 2. CREATING A SYSTEM VULNERABLE TO CVE-2017-8464 3. TOOLS FOR EXPLOITING CVE-2017-8464 PART 2: USING METASPLOIT TO EXPLOIT CVE-2017-8464 2.1...

Amsi-Bypass-Powershell

Sponsored by Amsi-Bypass-Powershell This repo contains some Antimalware Scan Interface AMSI bypass / avoidance methods i found on different Blog Posts. Most of the scripts are detected by AMSI itself. So you have to find the trigger and change the signature at the part via variable/function...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

XSW

XML Signature Wrapping XSW Burp Suite Extension XSW Burp Suite Extension automates the process of probing SAML endpoints for Signature Wrapping vulnerabilities. How to 1. Right-click on Authentication request at Burp Suite and choose "WRAP Attack". 2. Configure the dialog parameters and start the...

AndroidDriveSignity

AndroidDriveSignity AndroidDriveSignity is a Python script designed for patching Android kernelARMv8.3 files, enabling the loading of drivers without being subject to various verification checks, specifically signature verifications. This tool aims to facilitate the development and testing proces...

Weblogic_Wsat_RCE

WeblogicWsatRCE POC for CVE-2017-10271. Since java.lang.ProcessBuilder was the original vector for RCE, there are multiple signature based rules that block this particular payload. Added java.lang.Runtime and will add others in the future. This is for educational purposes only: I take no...

CVE-2013-3900-PowerShell-PoC

CVE-2013-3900-PowerShell-PoC This PoC is provided for educational and research purposes only. The author takes no responsibility for misuse or damage caused by this code. This PowerShell script is a testing tool for simulating the attack described in CVE-2013-3900. CVE-2013-3900 concerns the...

opnsense-firmware-mirror-sed

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-firmware-mirror-sed opnsense-firmware-mirror-sed Class: Signature skip Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org System: Firmware set POSTs a custom mirror / flavour. Core FILTERSANITIZEURL...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...