Limelighter

LimeLighter A tool which creates a spoof code signing certificates and sign binaries and DLL files to help evade EDR products and avoid MSS and sock scruitney. LimeLighter can also use valid code signing certificates to sign files. Limelighter can use a fully qualified domain name such as acme.co...

sslsplit

SSLsplit - 透明的SSL/TLS中间人攻击 https://www.roe.ch/SSLsplit 概述 SSLsplit是一种针对SSL/TLS加密网络连接执行中间人攻击的工具。它旨在用于网络取证、应用程序安全分析和渗透测试。...

chainoffools

CryptoAPI CVE-2020-0601：Windows CryptoAPI 欺骗漏洞利用。更多信息请参阅我们的博客文章。 安装依赖 root@kitploit: pip install -U -r requirements.txt 证书生成适用于最高 1.0.2u 版本的 OpenSSL。 CA 证书 我们使用了 USERTrust ECC Certification Authority，但也可以是任何基于 P-384 曲线的根证书。 为了生成与根证书公钥匹配的私钥，我们使用了脚本 gen-key.py （适用于 Python 3.6 及以上版本）： root@kitploit:...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601，通常称为 CurveBall，是一个漏洞，其中使用椭圆曲线密码学（ECC）的证书签名未被正确验证。 ECC 依赖于不同的参数。这些参数对于许多曲线都是标准化的。然而，微软并未检查所有这些参数。参数 G（生成元）未被检查，因此攻击者可以提供自己的生成元，这样当微软尝试验证证书是否来自可信 CA 时，它只会查找匹配的公钥，然后使用证书的生成元。NSA 在此处解释了此漏洞的影响及更多信息 here。 MicrosoftECCProductRootCertificateAuthority.cer 默认是...

CurveBall-CVE-2020-0601-PoC

CurveBall CVE-2020-0601 - PoC 该漏洞被称为 CurveBall，是由于使用 ECC 算法的证书验证无效所致。Windows 尝试从证书缓存中验证先前已验证过的证书，在此过程中，它仅检查证书的公钥是否相同，而不检查其他参数。 数学细节 为了伪造证书，我们明确设置参数如下： root@kitploit: d' = 1 G' = Q 如果需要更多信息，可以查看 finalreportmilestoneIV.pdf 文件中的数学细节部分。 使用方法（代码签名） 在此 PoC 中，我们使用 "Microsoft ECC Product Root Certificate...

CVE-2026-62243

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to incorrectly fall back to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to...

SUSE-SU-2026:2822-1 Security update for gnutls

This update for gnutls fixes the following issues - CVE-2025-14831: excessive resource consumption when verifying specially crafted malicious certificates containing a large number of name constraints and SANs bsc1257960. - CVE-2026-3833: incorrectly accepted domain names due to comparison during...

K000161963: Golang vulnerability CVE-2025-61727

Security Advisory Description An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example . com does not prevent a leaf certificate from claiming the SAN .example.co...

CVE-2026-56020

The CVE-2026-56020 affects the Webmin HTTP server (miniserv.pl). An unauthenticated attacker can bypass authentication by sending a forged HTTP header to impersonate any user who has an SSL client certificate configured, effectively spoofing certificate DNs to gain access. This is a network-based...

Webmin multiple vulnerabilities

RISK EVALUATION Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user. 2. RECOMMENDED PRACTICES Update to most recent available version of Webmin. 3. DESCRIPTION The Webmin HTTP server miniserv.pl allows...

ALPINE-CVE-2026-42769

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol CMP message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority RA level to t...

CVE-2026-46579 Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

A flaw was found in the OpenShift Router. When a Route has insecureEdgeTerminationPolicy set to Allow, the HTTP frontend does not remove X-SSL-Client- headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted X-SSL-Client- headers. As a resul...

CVE-2026-45574

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate self-signed, expired, wrong CN and intercept all SOAP traffic. This includes patient...

CVE-2026-42013

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to incorrectly fall back to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to...

CVE-2026-42012

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier URI or Service SRV Subject Alternative Names SANs. This could cause the certificate validation process to incorrectly fall back to...

CVE-2026-42012

CVE-2026-42012 affects the GnuTLS library. A remote attacker can craft a certificate with URI or SRV SANs that causes the validator to fall back to CN checks, bypassing proper SAN validation and enabling potential impersonation/MITM. Documented in multiple advisories and patches across distros: o...

CVE-2026-42012

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier URI or Service SRV Subject Alternative Names SANs. This could cause the certificate validation process to incorrectly fall back to...

EUVD-2026-32001

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate self-signed, expired, wrong CN and intercept all SOAP traffic. This includes patient...