EUVD-2026-81333

Transient DOS while parsing frame during channel usage...

CVE-2026-24081 Buffer Over-read in BT Controller

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled...

EUVD-2026-81323

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled...

CVE-2026-24081

CVE-2026-24081 is a buffer over-read in the Qualcomm Bluetooth (BT) Controller that causes a transient denial of service when processing a channel map with insufficient used channels while adaptive frequency hopping is fully enabled. The vulnerability requires no privileges or user interaction, o...

power_analysis

Power analysis attack over RSA Index Index Introduction Power Analysis Attacks RSA: A Short Introduction RSA Example Equipment Measuring Power: A Short Introduction Ohm's Law Kirchhoff's Voltage Law KVL Voltage Divider Shunt Resistor Example Power Measurement Fast Exponentiation Fast Exponentiati...

CVE-2018-10933

CVE-2018-10933 to test this code: get vulnerable version of libssh at homepage: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz uncompress and build, then go to example directory, there's a simple sshd server using libssh name: samplesshd-cb run this simple sshd by command: $ samplesshd-cb...

ica2tcp

About Ica2Tcp Ica2Tcp is a tool developed in C allowing to proxy any TCP connection inside a Citrix ICA connection. It is to Citrix what ssh -D is to SSH. Additional information can be found here: https://www.sstic.org/2022/presentation/ica2tcp/ Disclaimer This tool was developped as an internshi...

dns-black-cat

DNS-Black-CatDBC Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel. Server ported as a python script, which acts as DNS server with required functionalities to provide...

ghostsplice

GhostSplice: cross-channel trust fragmentation attack PoC Proof-of-concept code for GhostSplice , an attack from the ASSET Research Group. The full write-up is "The AI refused to steal the secrets. So we handed it a form.". The idea in plain words AI coding assistants like Cursor, VS Code with...

external_c2_framework

externalc2 framework Python framework for usage with Cobalt Strike's External C2 specification as described in the spec. The primary design goal is to be a very modular implementation of the external c2 spec that provides enough abstraction to easily implement C2 channels for Cobalt Strike...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...

mojo-v

Mojo-V：面向 RISC-V 的秘密计算 Mojo-V （发音为 “mojo-five” ）是一种新的 RISC-V 扩展，为 RISC-V 引入了面向隐私的编程能力。Mojo-V 实现了秘密计算，可在不依赖脆弱软件和程序员信任的情况下，实现安全、高效且数据无关的执行。通过将敏感数据隔离在专用的秘密寄存器中，并在第三方密钥下加密内存，Mojo-V 可防止泄露，并强制执行既盲（无直接泄露）又静默（无侧信道泄漏）的计算。该设计仅通过一个模式位和四条新指令即可无缝集成到现有 RISC-V ISA...

mmiotic

mmiotic An exploratory tool for MMIO timing — time any physical address, and dissect the hardware off the latency. Unexpectedly useful for hardware reverse-engineering, hypervisor fingerprinting, side-channelling device activity, register characterization, calibrating malicious triggers, and...

DET

DET 拡張可能 データ漏洩ツールキット DET（AS IS で提供）は、単一または複数のチャネルを同時に使用してデータ漏洩を実行するための概念実証です。 これは、潜在的な DLP の欠陥を特定するための概念実証です。機密データや実際のデータ（評価中など）を漏洩させるために使用してはなりません。 アイデアは、さまざまなデータ漏洩技術に対して、実装されたネットワーク監視およびデータ漏洩防止（DLP）ソリューションの構成をテストするための、任意のプロトコル/サービスをプラグイン可能な汎用ツールキットを作成することでした。 プライマリリポジトリはこちらに移動しました。 スライド DET...

copy.fail-mitigation-MLM

Create a new configuration channel State Channel in Multi-Linux Manager using the code from the copy-fail.sls file. Assign the config channel to all your machines and run it, or execute Highstate. This is a temporary fix!...

chackd

chackd chackd is a daemon which randomize each second the kernel parameter tcpchallengeacklimit to prevent side channel attacks Introduction A shortly presented side-channel attack has given strong attention of the community 1 . For lots of servers or smartphone devices this attack considered...

UniversalDVC

Universal Dynamic Virtual Channel connector for Remote Desktop Services UDVC Terminal Services or Remote Desktop Services are offering many hidden features for those who want to dig deeper. One of these services is the Dynamic Virtual Channel that enables us to communicate over an open RDP...

dnscat2

注: .zip ダウンロードのパスワードはすべて "password" です！ はじめに dnscat2 へようこそ。これはあなたを気分不良にさせず、殺さない DNS トンネルです！ このツールは、DNS プロトコル上に暗号化されたコマンド＆コントロール C&C チャネルを作成するために設計されています。これは、ほぼすべてのネットワークから抜け出す効果的なトンネルです。 この README ファイルには、実行を開始するために必要なすべての情報が含まれているはずです！ プロトコルの詳細、コード構造、将来の計画、その他のマニアックなことにもっと深く掘り下げたい場合は、doc/...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...

wikipedia-c2

Wikipedia-C2 Wikipedia C2 博客文章 这是一个演示项目，用于展示利用 Wikipedia 进行命令与控制（C2）。在 Josh Abraham 展示了利用 Slack 和 ICMP 的 C2 之后，我想探索一下互联网顶级站点中还有哪些其他选项可用于 C2。在查看 Wikipedia 的 API 后，我发现有一个用户选项 user-jsarbitraryKeyName 可以设置为“任意值”。后来我发现该值的最大长度为 65535 个字符，这对于 C2 来说绰绰有余。 开始使用 本项目需要 Python 3。它适用于 Windows、macOS 和...