CVE-2025-55315-PoC-Exploit

CVE-2025-55315 Pentest Tool HTTP Request Smuggling Exploitation Tool for ASP.NET Core Kestrel ⚠️ LEGAL WARNING THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY! Use ONLY on systems you own or have explicit written authorization to test Unauthorized access to computer systems is ILLEGAL Tool...

CVE-2026-21531

Security Feature Bypass in ASP.NET Core by Microsoft CVE-2026-21531 🌟 Description A vulnerability in the Azure SDK facilitates deserialization of untrusted data, enabling unauthorized attackers to execute arbitrary code over a network. ⚙️ Installation To set up the exploitation tool, follow these...

Covenant

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a...

CVE-2025-55315-Scanner-Monitor

CVE-2025-55315 Vulnerability Scanner and TLS Proxy This repository contains tools to detect and monitor ASP.NET Core applications vulnerable to CVE-2025-55315, which involves HTTP request smuggling due to conflicting HTTP headers. Tools Included 1. Python Vulnerability Scanner...

CVE-2025-55315-detection-playground

Here are some tests that can be performed against these services to observe different behavior on GET/POST routes between the patched and unpatched versions of Kestrel. GET against unpatched sends 200 and socket remains open printf 'GET / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding:...

SharpC2

SharpC2 SharpC2 is a Command & Control C2 framework written in C. It consists of an ASP.NET Core Team Server, a .NET Framework implant, and a .NET MAUI client...

RHEL 10 : .NET 8.0 (RHSA-2026:88474)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88474 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

dotnet: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network...

dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet: ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...