hyperfox

Hyperfox Hyperfox is a security auditing tool that proxies and records HTTP and HTTPS traffic between two points. Installation You can install the latest version of hyperfox to /usr/local/bin with the following command requires admin privileges: root@kitploit: curl -sL...

ForgeCert

ForgeCert ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

mkchain

mkchain Open source tool to help you build a valid SSL certificate chain. Description • How To Use • Parameters • How it works • Requirements • Other • License Description Is an open source tool to help you build a valid SSL certificate chain. Also can help you fix the incomplete chain and downlo...

CVE-2022-1292

CVE-2022-1292 POC Описание root@kitploit: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute...

ecapture

汉字 | English eCapture Наблюдатель: захват текстового содержимого SSL/TLS без сертификата ЦС с помощью eBPF. !IMPORTANT Поддерживает Linux/Android на x8664 ядро 4.18+ и aarch64 ядро 5.5+. Требования к версии ядра различаются в зависимости от архитектуры ЦП для Linux и Android. Требуются права ROOT...

chainoffools

CryptoAPI CVE-2020-0601: Windows CryptoAPI 스푸핑 취약점 악용. 자세한 내용은 블로그 게시물을 참조하세요. 설치 요구 사항 root@kitploit: pip install -U -r requirements.txt 인증서 생성은 OpenSSL 버전 1.0.2u까지 지원됩니다. CA 인증서 우리는 USERTrust ECC Certification Authority를 사용했지만 P-384 곡선에서 작동하는 모든 루트 인증서를 사용할 수 있습니다. 루트 인증서의 공개 키와 일치하는 개인 키를 생성하기...

test-certs-site

test-certs-site Введение Этот специально созданный веб-сервер предназначен для размещения тестовых страниц, необходимых для выполнения Базовых требований форума CA/Browser. Они содержат следующее требование: УЦ ОБЯЗАН размещать тестовые веб-страницы, позволяющие поставщикам прикладного программно...

CVE-2020-0601

CVE-2020-0601: Эксплуатация уязвимости CurveBall Этот скрипт на Ruby можно использовать для подмены легитимного центра сертификации и генерации сертификата, который будет считаться действительным для компьютеров Windows, затронутых уязвимостью CurveBall. Вам необходимо получить сертификат от цент...

caOptics

참고 개발 우선순위 변경과 커뮤니티 활동을 다른 영역PoC, 기타 도구, 데모/발표으로 재조정함에 따라 프로젝트가 보관 처리되었으며, 프로젝트는 읽기 전용으로 설정되었습니다. CA Optics - Azure AD Conditional Access Gap Analyzer Conditional Access란 무엇인가? 초기 테스터를 위한 참고 사항 릴리스 노트 문서 갭 예시 순열 생성 사전 요구 사항 중요 설명 - Conditional Access Gap 분석기 기존 도구와의 비교 범위 Opinionated 설계 설계 결정 플랫폼...

phishlulz

PhishLulz PhishLulz는 피싱 활동을 자동화하기 위한 Ruby 도구 세트입니다. 피싱 캠페인을 시작하면 전용 Amazon EC2 Debian 7 인스턴스가 생성됩니다. VM에는 다양한 오픈 소스 도구가 함께 제공되며, 주요 구성 요소는 다음과 같습니다: PhishingFrenzy https://github.com/pentestgeek/phishing-frenzy BeEF https://github.com/beefproject/beef PhishLulz는 자체 서명된 CA를 제공합니다: 이는 PhishingFrenz...

CVE-2022-1292

CVE-2022-1292 POC Описание root@kitploit: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute...

gringotts

CVE-2020-0601 概念実証 Windows 10 の CVE-2020-0601 脆弱性を利用して、独自のルート CA と署名済み証明書を作成する楽しい概念実証です。この問題の根本は、CertGetCertificateChain メソッドがルート証明機関を不適切に検証していたことにあります。トラストストア内の署名証明書を検索する処理はコストがかかるため、Microsoft はキャッシュを実装し、指定されたルート証明書の公開鍵を使ってその証明書が以前にトラストストアから読み込まれたかどうかを判断していました。しかし、楕円曲線証明書の場合、SubjectPublicKeyInfo...

CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

Повышение привилегий в CA Common Services CVE-2016-9795: повторное рассмотрение Описание Во время одного из моих пентестов я наткнулся на SUID-бинарник casrvc который является частью пакета CA Common Services. Как выяснилось, этот бинарник уязвим для локального повышения привилегий. Более того,...

EUVD-2026-76700

A reflected cross-site scripting XSS vulnerability in the p.rfihub.com component of Zeta Marketing Platform ZMP v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter...

CVE-2026-79035

A reflected cross-site scripting (XSS) vulnerability exists in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 . An attacker can inject a crafted URL into the ca parameter to execute arbitrary JavaScript in the victim's browser context. The provided references link to a proof-of-...

Fedora 44 : curl (2026-f26b509a1a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory. - Fix HTTP/2 stream-dependency tree UAF CVE-2026-10536 - Fix Native CA trust persist CVE-2026-11564 - Fix stale proxy password leak CVE-2026-9079 -...

CVE-2014-2734

CVE-2014-2734 Ruby OpenSSL CA 개인키 스푸핑 ============= Ruby openssl에는 공개키가 개인키 쓰기 이전에 발급되고 스크립트 중에 다시 열릴 때 CA 개인키를 스푸핑하는 취약점이 있습니다. PoC 스크립트 https://gist.github.com/10446549 Mitre: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2734 SecurityFocus: http://www.securityfocus.com/bid/66956...

ca-clone

CAクローニングスクリプト HTTPSクライアント攻撃で使用するCA証明書をクローンするためのスクリプト集です。現在、ルートComodo CAとDigicert CAをクローンするスクリプトが含まれており、どちらもIoTデバイスでかなり広く信頼されています。 使用方法 いずれかのスクリプトをその場で実行すると、キーと証明書が自動的に生成されます。一般的には、どちらか一方を実行するだけで十分ですが、特定のCAが必要になる可能性がある場合に備えて、両方がここに含まれています。 生成されたP12をHTTPSプロキシにインポートします。 Burpでは、Proxy - Options...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...