ForgeCert

ForgeCert ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was...

ecapture

eCapture 旁观者 Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. English · 汉字 !IMPORTANT Supports Linux on x8664 kernel 4.18+, aarch64 kernel 5.5+, and LoongArch64 loong64 kernel 6.6+. Android supports x8664 and aarch64 with the existing kernel minimums. Requires root...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

hyperfox

Hyperfox Hyperfox is a security auditing tool that proxies and records HTTP and HTTPS traffic between two points. Installation You can install the latest version of hyperfox to /usr/local/bin with the following command requires admin privileges: curl -sL...

test-certs-site

test-certs-site Introduction This is a purpose-built webserver for hosting the test pages required by the CA/Browser forum Baseline Requirements. They contain the following requirement: The CA SHALL host test Web pages that allow Application Software Suppliers to test their software with Subscrib...

CVE-2022-1292

CVE-2022-1292 POC Description The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary comman...

CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

RLSA-2026:98586 Important: NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband WWAN, and PPPoE devices, as well as providing VPN integration with a varie...

NetworkManager security update

An update is available for NetworkManager. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list NetworkManager is a system network service that manages network devic...

ca-clone

CA Cloning Scripts Scripts to clone CA certificates for use in HTTPS client attacks. Currently includes scripts to clone a root Comodo CA, and a Digicert CA, both of which are fairly widely trusted in IoT devices. Usage Run either script in place to automatically generate a key and certificate. I...

emsign-trust-scan

emSign / eMudhra compromise - trust-store scanner Detection tooling for the October 2026 eMudhra / emSign intermediate CA private-key compromise. Eight intermediate CAs were issued with P-384 keys whose private scalars were tiny integers recovered values 4, 56, 66, 115, 155, 156, 230, 237, so...

CVE-2026-29114

CVE-2026-29114 — Dahua Exposed Device CA Root Certificate Advisory type: Vendor-coordinated security disclosure CVE ID: CVE-2026-29114 Vendor: Dahua Technology Published: 2026-06-10T05:44:50 UTC Last Modified: 2026-06-10T05:44:50 UTC Source: Dahua Product Security Incident PSI Trust Center Table ...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

LR-WebPKI

LR+ WebPKI Evaluation Artifact This package contains the finalized LR+ reference implementation, production reconstruction wrappers, tests, and generated evaluation outputs for context-closed post-quantum authentication over WebPKI CA context. The package is intentionally written as a submission...

gringotts

CVE-2020-0601 proof of concept A fun proof of concept to create your own root CA and signed certificate based on the CVE-2020-0601 vulnerability in Windows 10. The basis for the issue is the CertGetCertificateChain method improperly validated root certificate authorities. Since the search for a...

InfraTest

DO NOT DEPLOY UNLESS FOR LEARNING ABOUT AWS!!! Currently vulnerable to CVE-2024-39689. We need to update Certifi. Check dependabot before deploying. Trusting an unverified Certificate Authority can have major loss of customer trust issues...

CVE-2026-123867

A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...

emudhra-weak-keys

emudra-weak-keys This is a Zeek package to detect connections that use eMudhra intermediate CA certificates with compromised/well-known private keys. For more information see, e.g., the original Bugzilla entry or https://emudhra.we-have-a-problem.com/. Please note that this detection only works f...

Alibaba Cloud Linux 3 : 0362: ca-certificates (ALINUX3-SA-2026:0362)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0362 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-114406: The system certificate authority C...

Medium: python-botocore

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...