socksmon

socksmon 使用您选择的HTTP拦截代理监控任意TCP流量 socksmon是什么？ socksmon是一个基于Twisted的SOCKSv4服务器，通过HTTP代理隧道传输传入的TCP流量。socksmon通过启动一个内部web服务器（端口2357）来实现这一点，将流量发送到中间人代理进行编辑，然后转发到目的地。 socksmon初步支持SSL拦截，这意味着可以使用您选择的拦截代理分析任意SSL加密的TCP流量。 如何使用？...

nosqlpot

NoSQL蜜罐框架 NoPo NoSQL蜜罐框架 NoPo 是一个开源的NoSQL数据库蜜罐，可自动检测攻击者并记录攻击事件。仿真引擎使用Twisted框架部署。当前该框架支持Redis。 注意：该框架正在开发中，可能存在漏洞。 截图 服务器已部署 安装 您可以通过克隆Git仓库下载NoPo： root@kitploit: git clone https://github.com/torque59/nosqlpot.git pip install -r requirements.txt NoPo在任何平台上均可与Python 2.6.x 和2.7.x 版本开箱即用。 新增功能：...

rdpy

RDPY 在 twisted python 中的远程桌面协议。 RDPY 是一个纯 Python 实现的微软 RDP（远程桌面协议）协议（客户端和服务端）。RDPY 构建于基于事件驱动的网络引擎 Twisted 之上。RDPY 支持标准的 RDP 安全层、基于 SSL 的 RDP 以及 NLA 认证（通过 ntlmv2 认证协议）。 RDPY 提供了以下 RDP 和 VNC 二进制工具： RDP 中间人代理，可记录会话 RDP 蜜罐 RDP 截图工具 RDP 客户端 VNC 客户端 VNC 截图工具 RSS 播放器 构建 RDPY 完全用 Python 实现，但位图解压缩算法出于性能考虑...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

Twisted - Open Redirect & XSS

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The Twisted web framework's redirectTo function is vulnerable to reflected XSS if an attacker can control the redirect URL. This template tests for an open redirect and XSS vulnerability in the URL parameter...

Astra Linux – Vulnerability in Twisted

Twisted is an event-driven networking engine written in Python. In affected versions, Twisted exposes cookies and authorization headers when performing cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions. Users are advis...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, potentially leading to information disclosure. This vulnerability has been fixed in 24.7.0rc1...

Astra Linux – Vulnerability in Twisted

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When a content-length and a chunked encoding header were provided, the content-length took precedence, and the remaining part of the request body was interpreted as a pipelined request...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications. It was introduced with version 0.9.4. At that time, when the host header did not match a configured host using twisted.web.vhost.NameVirtualHost, a “NoResource” resource would be returned. This caused the Host header to be rendered...

Astra Linux – Vulnerability in Twisted

In words.protocols.jabber.xmlstream in Twisted through version 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to intercept connections...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When two content-length headers were provided, the system ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web would process the requests asynchronously, without guaranteeing the order of responses. If either of the endpoints was controlled by an...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. Before version 22.2.0, Twisted’s SSH client and server implementations allowed accepting an infinite amount of data for the peer’s SSH version identifier. This resulted in a buffer that consumed all...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If the application code allows an attacker to control the redirect URL, this vulnerability may lead to Reflected Cross-Sit...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. Before version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than allowed by RFC 7230. This non-conformant parsin...

CLSA-2026-1786360302 TuxCare security update for twisted (3 CVEs)

TuxCare rebuilt twisted to address 3 CVEs. Fixed in 20.3.0.post5+tuxcare...

PYSEC-2026-1992 twisted.web has disordered HTTP pipeline response

Summary The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC 0. Start a fresh Debian container: sh docker run --workdir /repro --rm -it debian:bookworm-slim 1. Install twisted and its dependencies...

PYSEC-2026-1055 Twisted vulnerable to NameVirtualHost Host header injection

When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. Example configuration: python from twisted.web.server import Site from...

CVE-2026-42304

A flaw was found in Twisted, specifically within the twisted.names module. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted TCP DNS packet containing deeply chained compression pointers. This can lead to resource exhaustion, causing the...