http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...

Purdue-Model-for-Industrial-Control-System-Environments

Purdue Model for Industrial Control System ICS Environments Turkish This research paper has already been published before and you can also find the original .pdf version at here...

cset

What is CSET? The Cybersecurity Infrastructure Security Agency CISA and the Idaho National Laboratory INL develop the Cyber Security Evaluation Tool CSET® for asset owners with the primary objective of reducing the risk to the nation’s critical infrastructure. Control systems are defined as...

telegram-c2

Telegram C2 Command and control a server via telegram bots. Installation Tutorial Video Create a telegram bot Edit main.py, set BOTAPIKEY to the bot's api key and telegramuserid to your telegram id Install the following dependencies pip install -r requirements.txt Compile to standalone binary for...

CVE-2023-34965

CVE-2023-34965 SSPanel UIM is a multi-purpose agency service sales management system specially designed for Shadowsocks / V2Ray / Trojan protocols. SSPanel-Uim version before 2023.3 does not restrict access to the /link/ interface,which can lead to a leak of user subscription information. Detail...

CVE-2023-25690

CVE-2023-25690 Description of CVE-2023-25690: Some modproxy configurations on Apache HTTP Server from version 2.4.0 to 2.4.55 allow HTTP Request Smuggling attacks a technique that interferes with the way a website processes HTTP request sequences received from one or more users. These...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMS Broken Access Control → Account Takeover Missing authorization on the admin server-management routes in Azuriom CMS This PoC is published for defensive and educational purposes against a patched version. Only run it against systems you own or are explicitly authorized...

CVE-2025-25614

CVE-2025-25614 Incorrect Access Control in Unifiedtransform v2.0 leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint: /teachers/edit/3...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...

cloudpanel-2.4.2-CVE-2024-44765-recovery

CVE-2024-44765 is an Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel versions 2.0.0 to 2.4.2 1. Follow instructions in every folder this should be done locally 2. Reset Passwords and Access for root $ sudo passwd root while for users $ getent...

confluence-cve-2023-22515

confluence-cve-2023-22515 Confluence Broken Access Control : CVE-2023-22515...

quasibot

quasiBot quasiBot 0.3 - Read Me 07.08.14 Agenda QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average...

CVE-2023-49981

CVE-2023-49981 School Fees Management System v1.0 - Incorrect Access Control - Directory Listing Description : A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring...

CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Broken Access Control Proof of concept for a missing-authorization flaw in MISP's bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorize each selected item with a callback that ignores the item and returns the caller'...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

CVE-2026-33146

CVE-2026-33146 A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results. Intro I found this issue while reviewing Docmost , an open-source...

CVE-2026-48907

🚨 CVE-2026-48907 - JCE Joomla Content Editor Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in JCE Joomla Content Editor A critical access control vulnerability allowing unauthenticated attackers to compromise vulnerable Joomla installations running JCE. 📖 Overview...

Malware

Malware macOS Malware Collection ⚠️ This page contains links to live malware! By downloading malware from this site, you waive all rights to claim any damages resulting from mishandling or self-infection. 📡 Running the samples, may results in connections to attack controlled infrastructure e.g...

uhubctl

uhubctl uhubctl is utility to control USB power per-port on smart USB hubs. Smart hub is defined as one that implements per-port power switching. Original idea for this code was inspired by hub-ctrl.c by Niibe Yutaka: https://www.gniibe.org/development/ac-power-control-by-USB-hub Compatible USB...