domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

cookie_crimes

Chrome Cookie Extraction Without Root This will print out a user's Chrome cookies. You don't need to have their password or be root to use it. nice nice nice nice nice. If you are not the kind of person who regularly gets the ability to execute code on other people's computers, you probably don't...

WSC2

WSC2 LAST/CURRENT VERSION: 0.1 Author: Arno0x0x - @Arno0x0x WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distributed under the terms o...

ExternalC2

ExternalC2 A library for integrating communication channels with the Cobalt Strike External C2 server This library provides an implementation of the Cobalt Strike External C2 spec, including a basic web channel and a websocket channel. The codebase has been documented and designed to allow...

WS_RaceCondition_PoC

Race Conditions in Websockets In the field of information technology, ensuring data reliability and integrity is crucial, especially with millions of users and terabytes of data in the mix. However, as software systems become more complex, issues such as race conditions can arise, significantly...

Lastenzug

LastenZug This project implements a Socka4a proxy based on websockets. The client component is implemented in C compiling down to fully position independent code PIC. During the compilation process, obfuscation is applied on assembly level by leveraging a second tool: SpiderPIC located in...

raven

Raven CobaltStrike External C2 for Websockets Additional info: https://www.cobaltstrike.com/help-externalc2 Server Build Ubuntu Copy the server folder to your VPS. Run ./setup.sh as root or with sudo Client build Windows Copy the client folder to a Windows development host. Install the Windows 10...

pyFlipper

PyFlipper Flipper Zero Python CLI Wrapper Articles How to hack a restaurant Functions and characteristics: Flipper serial CLI wrapper Websocket client interface Plain TCP interface What's new firmware 1.x compatibility This release brings the wrapper in line with the current Flipper Zero CLI...

sonar.js

sonar.js A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar....

Lastenzug

LastenZug This project implements a Socka4a proxy based on websockets. The client component is implemented in C compiling down to fully position independent code PIC. During the compilation process, obfuscation is applied on assembly level by leveraging a second tool: SpiderPIC located in...

reinschauer

Reinschauer A PoC to remotely control Windows machines over Websockets. Check out my blog for a writeup. Can be executed as Go exe, .NET/C exe and in-memory using BOF.NET and Cobaltstrike. Traffic can be tunneled via an interactive Beacon connection. Other than most HVNC implementations,...

CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

SUSE CVE-2026-113037

Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113037

An use after free flaw was found in the WebSockets component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=560939312 https://code.google.com/p/chromium/issues/detail?id=113037...

EUVD-2026-105650

Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-113037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

WebSockets Component DoS

The WebSocket component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

DEBIAN-CVE-2026-113037

Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113037

Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113037

Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...