Aegis

Aegis Authenticator Aegis Authenticator 是一款免费、安全且开源的 Android 2FA 应用。它旨在为你的在线服务提供安全的验证器，同时包含现有验证器应用所缺失的一些功能，如完善的加密和备份。Aegis 支持 HOTP 和 TOTP，可兼容数千种服务。 如需常见问题列表，请查看 FAQ。 应用的安全设计及保险库格式在 此文档 中有详细描述。 特性 免费且开源 安全 保险库已加密（AES-256-GCM），可通过以下方式解锁： 密码（scrypt） 生物识别（Android Keystore） 防止屏幕截图 点击显示 兼容 Google...

zappzarapp-php-security

⚡ zappzarapp/security 全面的 PHP 安全库，提供 CSP、安全响应头、CSRF 防护、安全 Cookie、密码验证、输入净化、速率限制、SRI、密钥加载、加密、会话安全、TOTP 双因素认证、签名 URL 和安全事件日志记录。 亮点 一体化 — 单个可组合包中包含 17 个安全模块 默认安全 — 严格的 CSP，无 unsafe-，HTTPS 优先 框架无关 — 适用于任何 PHP 8.4+ 应用程序 不可变且类型安全 — readonly 类、枚举、with API 质量保障 — PHPStan Level 8、Psalm Level 1、100% Mutati...

totp-ssh-fluxer

TOTP SSHポートフラクシング 一部の人は、サーバーのSSHポートを変更して、ボットやその他の厄介なものに見つかりにくくしています。これは一般的に隠蔽によるセキュリティと見なされますが、実際には/var/log/auth.logで常に見られる自動ログインの多くを排除するのに非常に効果的です。 しかし、これをさらに馬鹿げたレベルに引き上げたらどうでしょうか？通常はウェブサイトへのログインの第2要素として使用されるTOTPコードを、実際にsshdサーバーが待ち受けているポートを知るために使うとしたら？...

totp-ssh-fluxer

TOTP SSH port fluxing Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in...

cobaltstrike4.5_cdf-1

cobaltstrike4.5cdf cobaltstrike4.5 版のクラック、checksum8 特徴の除去、BeaconEye のバイパス、エラーパスによる stage 漏洩の修正、TOTP 二段階認証の追加、ユーザー名の暗号化表示の追加、4.5 版の foreign 派生エラーのバグ修正、クライアント設定ファイル名の変更など cobalt strike4.5 クラック cobaltstrike4.5 クラック TOC 免責事項 / 免責契約...

proxmark3

Iceman Fork - Proxmark3 The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast. Iceman repository is considered to be...

hotpot

Hotpot 🍲 Authy / Google Authenticator のコマンドライン版。 Hotpot は、TOTPベースの二要素認証コードを管理する、シンプルで安全なコマンドラインツールです。2FAのシークレットをシステムのキーリングに安全に保存し、必要なときに時間ベースのワンタイムパスワードを生成します。 セキュリティ、パフォーマンス、信頼性のために Rust で構築されています。 特徴 安全な保存 : システムキーリング（Keychain/libsecret/Credential Manager）を使用 TOTP RFC 6238 コード生成:...

EUVD-2026-69555

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...

CVE-2026-84306

Filament , a Laravel full-stack component library, is affected by a flaw in app-based multi-factor authentication (versions 4.0.0–4.12.6 and 5.7.6). In AppAuthentication::verifyCode(), the used-code cache key is derived from both the authentication secret and the submitted TOTP code , causing the...

PT-2026-84400

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.6 Filament versions prior to 5.7.6 Description An issue exists in the handling of one-time codes for app-based multi-factor authentication MFA. The AppAuthentication::verifyCode function uses a cache key derived...

about_cobaltstrike4.5_cdf

aboutcobaltstrike4.5cdf cobaltstrike4.5バージョンのクラック、checksum8特徴の除去、BeaconEyeの回避、誤ったパスによるstageリークの修正、TOTP二要素認証の追加、CVE-2022-39197の修正など このプロジェクトをお探しの場合：cobaltstrike4.5cdf はい、またもやブロックされました：Repository unavailable due to DMCA takedown...

CVE-2026-45332-PoC

CVE-2026-45332：Automad CMS 中的失效访问控制 CVE-2026-45332 的概念验证，Automad CMS 中的失效访问控制漏洞，允许任何未经身份验证的攻击者通过设置端点转储每个管理员账户的 bcrypt 密码哈希和 TOTP 密钥，该端点在初始配置后永远不会被禁用。 字段| 值 ---|--- CVE| CVE-2026-45332 GHSA| GHSA-xm76-r88j-vm3g 产品| Automad CMS composer automad/automad 受影响版本| = 2.0.0-alpha.1，generatePHP; //...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

EUVD-2026-68127

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth (a Ruby authentication library) before 2.47.0 contains a TOTP code reuse vulnerability in its otp feature. The root cause is a failure to track the last accepted code timestamp, allowing an attacker who observes a valid time-based one-time password to replay it within the drift window and...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE Improvised Beschreibung Nutzt eine Pre-Auth-NoSQL-Injection-Schwachstelle in Rocket.Chat 3.12.1 aus, um das TOTP-Geheimnis des Administrators und das Passwort-Reset-Token zu erlangen, das Admin-Konto zu übernehmen und über eine bösartige Webhook-Integration...