You-re-Doing-IoT-RNG

你的IoT RNG做法不对 本仓库包含我们的研究结果，以及用于在多个设备上生成随机数的设备代码。如需更完整地了解相关漏洞和问题，请观看我们在DEF CON 21上的演讲： https://www.youtube.com/watch?v=Zuqw0-jZh9Y 或者，如果你更喜欢阅读文字，可以在此处了解该问题的全部细节： https://labs.bishopfox.com/tech-blog/youre-doing-iot-rng 点击进入各个设备文件夹的README以了解详情。...

mose

MOSE（Master Of SErvers） Copyright 2020 National Technology & Engineering Solutions of Sandia, LLC NTESS. NTESSとの契約（DE-NA0003525）に基づき、米国政府は本ソフトウェアに一定の権利を保持します。 MOSEは、侵害後に構成管理（CM）システムを活用するためのポストエクスプロイテーションツールです。Puppet、Chef、Salt、Ansible...

patoolkit

.. image:: https://user-images.githubusercontent.com/743886/43845704-6dbd2558-9ae1-11e8-9f77-239210fe7b6a.png PA Toolkit Pentester Academy Wireshark Toolkit PA Toolkit is a collection of traffic analysis plugins to extend the functionality of Wireshark from a micro-analysis tool and protocol...

Application-Security-Curriculum

Application-Security-Curriculum Grant Ongers - 教育を通じたAppSecのスケーリング - DEF CON 29 AppSec Village...

dcsgonebadge

DEF CON シンガポール ワンバッジ このプロジェクトは、Circuit Crafters の最初のプロジェクトである電子ハードウェアバッジのハードウェア設計を管理します。このバッジは、マリーナベイサンズ エキスポ＆コンベンションセンターで開催される DEF CON Singapore 2026 セキュリティカンファレンスで配布される予定です。 ライセンス このプロジェクトは、CERN Open Hardware Licence Version 2 - Strongly Reciprocal CERN-OHL-S. の下でライセンスされています。あなたは CERN-OHL-S...

edrEvasionWorkshop

edrEvasionWorkshop 工作坊材料，主题为“逐步恶意软件开发：从加载器到内核规避EDR”，已在 DEF CON 34和 BSidesLV 2026上展示。 本工作坊探讨自定义恶意软件开发、EDR架构与规避、C2定制以及内核级技术，以Elastic Defend 作为目标EDR。 逐步恶意软件开发：从加载器到内核规避EDR 来自DEF CON 34 和BSidesLV 2026 的工作坊材料。 材料涵盖的主题包括： EDR架构 APC注入 Fiber 模块踩踏（Module Stomping） 调用栈欺骗 间接系统调用 使用Havoc进行C2定制 内核级攻击...

LiveCTF-DEFCON30

LiveCTF 2022 本仓库用于存储 DEF CON CTF 决赛 LiveCTF 活动的挑战、基础设施说明、直播配置以及其他受版本控制的信息。 LiveCTF 中使用的挑战 | 挑战名称| 参赛队伍| 胜者 ---|---|---|--- 十六强赛: 1| syscall-me-maybe| Shellphish vs PTBWTL| Shellphish 十六强赛: 2| open-to-interpretation| StarBugs vs ./V /home/r/.bin/tw| StarBugs 十六强赛: 3| nopcoding| OSUSEC vs Maple...

DC30_Workshop

DEF CON 30 研讨会大型机容器 这里的脚本用于为 DEFCON 30 研讨会构建 MVS 3.8j 虚拟大型机。 感谢您关注 DEFCON 30 大型机缓冲区溢出研讨会。 使用 Docker 此 Docker 容器包含学习 MVS 缓冲区溢出所需的全部内容！ 要开始课程，请运行容器并访问 http://localhost:8080 要运行容器，请使用以下命令，确保将 $pwd/docker 改为适合您系统的文件夹。$pwd 会将 Docker 卷放在当前工作文件夹中。 最小容器 如果您只想自包含运行，请使用此命令。⚠️ 如果您删除并重新启动容器，您将丢失对大型机环境所做的所有更改。...

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup 目录 介绍 挑战第 1 部分：收集音符 挑战第 2 部分：呼叫 YИИEႱ 挑战第 2A 部分：Alice 挑战第 2B 部分：Bob 挑战第 2C 部分：Carol 挑战第 2D 部分：Dan 挑战第 2E 部分：Eve 挑战第 2F 部分：Trevor 挑战第 3 部分：最终线索 如果我错过了大会上的电话怎么办？ 后记 介绍 大家好！我是 Pete，也叫 Kybr，这是我为 DEF CON 30 徽章挑战赛写的解题报告。...

SUSE CVE-2026-80772

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

AZL-99672 CVE-2026-80772 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

CVE-2026-80772

CVE-2026-80772 is an out-of-bounds read in the Linux kernel 's HID Nintendo driver, specifically in joycon_ctlr_read_handler(). The function guards a cast of incoming HID input reports to a 49-byte struct joycon_input_report with only a 12-byte length check. A 12-byte report with data[0] == JC_IN...

CVE-2026-80771

CVE-2026-80771 affects the Linux kernel 's HID Nintendo (Joy-Con) driver. In joycon_input_create(), input_register_device() was called before joycon_config_rumble() configured the FF_RUMBLE capability and the memless force-feedback device. This allowed a concurrent EVIOCSFF ioctl to dereference a...

CVE-2026-80771 HID: nintendo: register input device after capabilities are set

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set inputregisterdevice exposes the device to userspace immediately. In joyconinputcreate it was called before joyconconfigrumble configures the FFRUMBLE capability and...

Linux Distros Unpatched Vulnerability : CVE-2026-80772

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Added a terminator to gpiodlookuptable Without the terminator, if a conid is passed to gpiofind, and this conid does not exist in the lookup table, the function will not stop looping correctly. This could lead to a O...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A data race flaw was discovered in the Linux kernel, between the allocation of the con variable and the setting of con-sock. This issue results in a NULL pointer dereferencing when accessing con-sock-sk in the net/tipc/topsrv.c file within the tipc protocol in the Linux kernel...

PT-2026-79680

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd keycode with tty port tty get kbd keycode reads vc-port.tty without acquiring a tty reference, racing against con shutdown which clears port.tty under a different lock. Use tty port tty get/tty...

kernel: vt: prevent kernel-infoleak in con_font_get()

In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in confontget font.data may not initialize all memory spaces depending on the implementation of vc-vcsw-confontget. This may cause info-leak, so to prevent this, it is safest to modify it to initialize...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: A memory leak was fixed in amdgpurasinit. When amdgpunbiorasswinit fails in amdgpurasinit, the function returns directly without freeing the allocated con structure, resulting in a memory leak. This issue was fixed by...