331 matches found
slipstream
NAT Slipstreaming NAT Slipstreaming permite a un atacante acceder remotamente a cualquier servicio TCP/UDP vinculado a cualquier sistema detrás del NAT de la víctima, evitando el NAT/cortafuegos de la víctima control remoto arbitrario de agujeros en el cortafuegos, simplemente con que la víctima...
jsunpack-n
jsunpack-n jsunpack-n emula la funcionalidad del navegador al visitar una URL. Su propósito es detectar exploits que apuntan a vulnerabilidades del navegador y sus complementos. Acepta muchos tipos diferentes de entrada: Archivos PDF - samples/sample-pdf.file Capturas de paquetes -...
sonar.js
sonar.js 一个用于识别并利用内部网络主机漏洞的框架。通过 WebRTC IP 枚举、WebSocket 主机扫描以及外部资源指纹识别实现。 它是如何工作的？ 在现代 Web 浏览器中加载 sonar.js 负载后，将发生以下过程： sonar.js 会使用 WebRTC 枚举出加载该负载的用户所具有的内部 IP 地址。 随后 sonar.js 会尝试通过 WebSocket 发现内部网络中的存活主机。 如果发现存活主机，sonar.js 会通过 和 尝试链接到该主机，并挂钩 onload 事件，从而对主机进行指纹识别。如果预期的资源成功加载，将触发预设的 JavaScript...
PyStegosploit
PyStegosploit - Entrega de Exploits mediante Esteganografía y Políglotas video1 | video2 | página por Charmve - yidazhang1 at gmaildotcom, @Charmve @therealsaumil @amichael Mayo 2021 Stegosploit crea una nueva forma de codificar exploits de navegador "drive-by" y entregarlos a través de archivos ...
henkaku
Build Only Linux is supported. You will need: Python 3 Vita SDK Uglify JS Ubuntu 16.04 package node-uglify tested version 2.4.15 Other standard tools that you should already have installed, such as openssl, dd, cat, touch All tools should be in your PATH. Run ./build.sh to build everything. This...
C2-and-Post-Exploitation-Framework
Capstone Docker Lab Overview and Purpose The victim browses to a hosted webpage. The exploit initiates via shellcode embedded in utils.js runs client-side in the victim's browser via CVE-2021-21220. The shellcode runs on the victim's machine, calls the HTTPS delivery server, downloads...
jitsploitation
jitsploitation Exploit de navegador iOS para CVE-2020-9802, un antiguo bug de JIT. Este es un exploit para un bug popular del compilador JIT en el motor WebKit para macOS y iOS originalmente documentado por Project Zero. Reimplementé el exploit para este bug como un ejercicio de aprendizaje de...
CVE-2016-3861
CVE-2016-3861 Una versión extendida del exploit libutils de Mark Brand, del artículo del blog de Google Project Zero: https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html Principales diferencias: todos los archivos mp4 utilizados para la explotación se generan...
CVE-2026-73827
SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...
Malicious code in npm-builderio-qwik-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a743cdce28dd141d636ff13baaee44df53fbaaed17efdc5a7380281b7097e1 The package's main entry index.js is a working browser exploit, not a library. When loaded in a DOM context, it creates a hidden iframe pointing at...
📄 WebRemoteControl Unauthenticated Remote Filesystem Access
WebRemoteControl suffers from an unauthenticated remote filesystem access vulnerability. This proof of concept exploit lets you browse directory contents and access files. Exploit Title: WebRemoteControl - Unauthenticated Remote Filesystem Access Date: 2026-04-14 Exploit Author: Chokri Hammedi...
SUSE CVE-2025-64443
MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertiseme...
New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands
Cybersecurity researchers have discovered a new vulnerability in OpenAI's ChatGPT Atlas web browser that could allow malicious actors to inject nefarious instructions into the artificial intelligence AI-powered assistant's memory and run arbitrary code. "This exploit can allow attackers to infect...
EUVD-2019-3890
Malware in sbrugna...
EUVD-2021-13394
Malware in sbrugna...
EUVD-2016-6112
Malware in sbrugna...
EUVD-2016-3865
Malware in sbrugna...