3872 matches found
FUD-UUID-Shellcode
FUD-UUID-Shellcode 介绍 另一种使用C++的shellcode注入技术，试图通过XOR加密魔法和UUID字符串疯狂 来绕过Windows Defender :。 工作原理 Shellcode生成 首先，生成一个二进制格式的payload（可以使用 Havoc、CobaltStrike 或 msfvenom），例如使用 msfvenom，可以这样做（我使用的payload仅用于演示 目的，你可以使用任意payload）： msfvenom -p windows/messagebox -f raw -o shellcode.bin 然后使用Python3脚本...
EUVD-2026-88386
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...
CVE-2026-54674
The FreePBX open source IP PBX is vulnerable to authenticated command injection in the User Control Panel (UCP) interface prior to versions 16.0.39 and 17.0.7 . The root cause is insufficient sanitization of specific URL parameters, which allows an authenticated user to execute arbitrary commands...
Find-VulnerableElectronVersion
Find-VulnerableElectronVersion Escanea un ejecutable y determina si estaba empaquetado en una versión de Electron vulnerable a la vulnerabilidad de Chromium CVE-2023-4863/ CVE-2023-5129 mediante la herramienta Strings de Sysinternals. Solo compatible con dispositivos Windows. Requiere que...
CVE-2023-32784-kdbxpassdmp
keepassdumper.py Puerto en Python de vdohney/keepass-password-dumper CVE-2023-32784 — todo el crédito de la implementación original en C y de la técnica subyacente pertenece a vdohney. El script escanea un volcado de memoria de un proceso en busca de las cadenas de renderizado residuales que el...
EUVD-2026-88165
BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...
Uncontrolled Resource Consumption
jackson-databind is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the deserialization of arbitrarily long numeric components in XML datatype strings without length validation, which allows an unauthenticated attacker to submit specially crafted JSON values that caus...
xz-cve-2024-3094
root@ubuntu:/xz/ apt update root@ubuntu: /xz/ apt install -y gcc g++ vim net-tools make cmake build-essential libncurses-dev flex bison libssl-dev libelf-dev bc liblz4-tool liblz4-dev liblzma-dev ... ... root@ubuntu:/xz/ bash ./decode.sh root@ubuntu: /xz/ tar xf xz-5.6.1.tar.xz && cd xz-5.6.1...
fake-useragent
fake-useragent Up-to-date simple useragent faker with real world database. Features Data is pre-downloaded & post-processed from Intoli LLC and the data is part of the package itself The data consists of a wide range of browser agents and various browsers Retrieves user-agent strings both of type...
ghidra_stack_strings
Ghidra Stack-strings Un script para detectar stack-strings escritos por las instrucciones x86/x64 seleccionadas, emuladas mediante Unicorn. El script está escrito en Python 3, por lo que necesita Ghidrathon...
bst
二进制字符串工具包 概述 二进制字符串工具包（简称 BST）是一个相当简单的实用程序，用于将二进制字符串转换为适合包含在源代码中的各种格式，例如安全领域用于开发漏洞利用和概念验证的代码。 功能 以二进制字符串格式转换二进制文件并转储到标准输出。 将纯十六进制输入字符串转换为十六进制转义版本。 生成用于检测缓冲区中坏字符的坏字符序列。 限制二进制字符串的宽度，提高漏洞利用代码的可读性。 以你最喜欢的编程或脚本语言的语法格式化二进制字符串，例如： C/C++ Python PowerShell 执行自动变量块缩进，便于复制/粘贴包含。 依赖 POSIX C 库 C 编译器 GCC LLVM...
Mangle
此存储库已归档 要查看最新版本的 Mangle 或提交问题，请参考 https://github.com/Tylous/Mangle。 Mangle 作者：Tyl0us 在 Source Zero Con 2022 上展示 Mangle 是一款用于操作已编译可执行文件（.exe 或 DLL）的工具。它可以移除基于已知入侵指标（IoC）的字符串并用随机字符替换，通过增加文件大小来规避 EDR 检测，以及从合法文件中克隆代码签名证书。通过这种方式，Mangle 帮助加载器规避磁盘和内存扫描器。 贡献 Mangle 使用 Golang 开发。 安装 首先，克隆仓库。在编译 Mangle...
Linux Distros Unpatched Vulnerability : CVE-2026-79616
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. CVE-2026-79616 Note that Nessus relies on the presence ...
CVE-2026-96748
A flaw was found in pymongo. The driver improperly decodes percent-encoded characters in connection strings before separating host entries on delimiters. If an application incorporates untrusted hostnames into its connection strings, a remote attacker can inject arbitrary servers into the databas...
cve-2021-44228-waf-tests
Script bash sencillo para probar tu WAF u otros dispositivos contra cadenas de ataque Log4Shell y varios bypass Trucos de bypass de: https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words Para ejecutarlo: ./cve-2021-44228.sh -t -c O para usar los valores predeterminados de...
CVE-2026-97058
A flaw was found in sprintf-js. A remote attacker, by controlling format strings, can inject precision values that exceed ECMAScript limits. This lack of validation leads to uncaught RangeError exceptions, allowing the attacker to abort calling operations with a minimal payload, resulting in a...
USN-8808-1 sqlparse vulnerabilities
It was discovered that SQL parse contained multiple algorithmic complexity flaws when parsing SQL statements with deeply nested parentheses, comments, or dollar-quoted string literals. An attacker could use this issue to cause SQL parse to consume excessive CPU resources, resulting in a denial of...
CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
EUVD-2026-85157
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash...
