TokenBreaker

TokenBreaker Token Breaker is focused on 2 particular vulnerability related to JWT tokens. None Algorithm RSAtoHMAC Refer to this link about insights of the vulnerability and how an attacker can forge the tokens Try out this vulnerability here TheNone Usage usage: TheNone.py -h -t TOKEN...

CVE-2026-21003-JWT-none-Algorithm-Bypass-via-kid-Header-Omission

CVE-2026-21003 – JWT "none" Algorithm Bypass via kid Header Omission Program Code Node.js // jwtverifyserver.js - Vulnerable JWT verification const jwt = require'jsonwebtoken'; const express = require'express'; const app = express; app.useexpress.json; const publicKey = -----BEGIN PUBLIC KEY-----...

princeprocessor

princeprocessor Standalone password candidate generator using the PRINCE algorithm The name PRINCE is used as an acronym and stands for PRobability INfinite Chained Elements, which are the building blocks of the algorithm Brief description The princeprocessor is a password candidate generator and...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

DGA-Detection

DGA-Detection More and more malware is being created with advanced blocking circumvention techniques. One of the most prevalent techniques being used is the use of Domain Generation Algorithms which periodically generates a set of Domains to contact a C&C server. The majority of these DGA domains...

CVE-2021-44910_SpringBlade

CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k...

Total-Commander-FTP-Password-Recovery-Tool-Python

Total Commander FTP password recovery Python Total Commander formerly known as Windows Commander is a classic file manager for Windows, Windows CE, Windows Phone, and now also Android. Total Commander has a built-in FTP/FXP client and it keeps the FTP logins and encrypted passwords in wcxftp.ini...

AFL

american fuzzy lop Originally developed by Michal Zalewski [email protected]. See QuickStartGuide.txt if you don't have time to read this file. 1 Challenges of guided fuzzing Fuzzing is one of the most powerful and proven strategies for identifying security issues in real-world software; it ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle

Summary IBM App Connect Enterprise Toolkit and Runtime are vulnerable to multiple vulnerabilities due to Bouncy Castle. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on al...

poc-cve-2016-10555

Change the algorithm RS256asymmetric to HS256symmetric - POC CVE-2016-10555 The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. If you change the algorithm from RS256 to...

TP-Link-TL-WR820N-CVE-2025-14175

🔐 CVE-2025-14175 Weak Algorithm Support in SSH Server – TP-Link TL-WR820N Overview This repository documents a security vulnerability identified in the SSH server implementation of the TP-Link TL-WR820N v2.80 router. The vulnerability allowed the use of weak cryptographic algorithms , potentially...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – JWT Algorithm Confusion via kid Injection Program Code Node.js server + Python exploit // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const axios = require'axios'; cons...

CVE-2025-63353

CVE-2025-63353: Predictable Wi-Fi Password Vulnerability in FiberHome GPON ONT Devices References Based on research by Hanianis original CVE disclosure at CVE-2025-63353 Thanks to the security researchers who identified this vulnerability. Legal Disclaimer This information is provided for...

POC_CVE-2015-9235

CVE-2015-9235 Demonstration of the algorithm confusion attack on Json Web Token JWT libraries. JWTs are often used in cookies to certify a user session and so this attack is critical. The node module [email protected] was used to demonstrate the vulnerability. This project was also a nice vi...

CVE-2023-48223

CVE-2023-48223 PoC fast-jwt Algorithm Confusion This repository demonstrates JWT algorithm confusion in fast-jwt when token verification does not lock allowed algorithms. Environment Setup Requirements Node.js 18 or newer npm OpenSSL must be available in your terminal PATH 1 Install dependencies...

CVE-2026-87947

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107580

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...