364 matches found
refresh
Refresh This container emulates the vulnerable functionality of CVE-2022-1388 in an F5 Router allowing RCE. CVE-202201388 stems from a complicated relationship between different authentication mechanisms and broxying that stripped Headers allowing improper access to admin endpoints in the webapp...
aegis
Aegis Kernel-mode process protection driver using ObRegisterCallbacks to strip memory access permissions from handles. Basic implementation that hooks handle creation and removes PROCESSVMREAD/WRITE/OPERATION from unauthorized access attempts. Note: If the GIF doesn't animate, view it directly on...
striptls
striptls - auditing proxy poc implementation of STARTTLS stripping attacks A generic tcp proxy implementation and audit tool to perform protocol independent ssl/tls interception and STARTTLS stripping attacks on SMTP, POP3, IMAP, FTP, NNTP, XMPP, ACAP and IRC...
striptls
striptls - proxy d'audit implémentation poc des attaques de délestage STARTTLS Une implémentation générique de proxy TCP et outil d'audit pour effectuer des interceptions ssl/tls indépendantes du protocole et des attaques de délestage STARTTLS sur SMTP, POP3, IMAP, FTP, NNTP, XMPP, ACAP et...
CVE-2019-13498
CVE-2019-13498 Название эксплойта: MITM - Отсутствие HSTS, приводящее к краже учетных данных и манипуляции контентом Дата: 07/10/2019 Автор эксплойта: Furqan Khan Домашняя страница вендора: https://www.oneidentity.com/ Ссылка на ПО: https://www.oneidentity.com/products/cloud-access-manager/ Верси...
phantom-frida
phantom-frida phantom-frida собирает Android Frida Server и Gadget из исходного кода, изменяя при этом целевой набор наблюдаемых идентификаторов времени выполнения. Это сборочный и проверочный стенд, а не обещание, что каждый специфичный для приложения метод обнаружения будет обойдён. Текущая цел...
xepor
Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...
KsDumper
🔴 This repo is outdated due to the Capcom driver being patched 🔴 Thanks to mastercodeon314 there's now a port working on Windows 11. Enjoy ! https://github.com/mastercodeon314/KsDumper-11 KsDumper I always had an interest in reverse engineering. A few days ago I wanted to look at some game...
redact
redact Удаляет похожий на учётные данные контент из строк произвольной формы до того, как он попадёт в журналы, телеметрию или на любую стороннюю поверхность Частьнабора инструментов phpboyscout Go — небольшие Go-модули без фреймворков, извлечённые из go-tool-base. Документация:...
FRAGNESIA-Charan-cve-2026-46300
Charantej Architecture: Hardened Container Staging & Syscall Telemetry Lab An enterprise-grade, defense-in-depth container containment and runtime security telemetry framework. Designed from the perspective of a Cisco Lead Cybersecurity Architect, the Charantej Architecture isolates staging...
EUVD-2026-68335
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...
watermarks-remover
root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...
mysslstrip
mysslstrip mysslstrip è un proof of concept basato su Python che mostra come intercettare il traffico MySQL e rimuovere SSL/TLS, come da CVE-2015-3152. Utilizzo mysslstrip.py -h -p LISTENPORT -i LISTENINTERFACE dest Esempio di output root@kitploit: root@duo1 python2.7 mysslstrip.py -p 3307...
UBUNTU-CVE-2026-79782
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...
CVE-2026-79782
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...
CVE-2026-79782
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...
Astra Linux – Vulnerability in Ruby 2.5, JRuby
A issue was discovered in Ruby between versions 2.6.7, 2.7.x up to 2.7.3, and 3.x up to 3.0.1. The Net::IMAP library does not raise an exception when the StartTLS command fails with an unknown response. This may allow man-in-the-middle attackers to bypass TLS protections by leveraging the network...
CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...
