aotopsy

AOTopsy A Dart AOT snapshot analyzer. Turns libapp.so — the compiled Dart code inside a Flutter release APK — into function names, class layouts, call graphs, behavioral signals, and readable pseudocode. No Dart VM, no SDK compilation, no runtime fallback. Fork notice: AOTopsy is a fork of...

blutter

Blutter Flutter Mobile Application Reverse Engineering Tool by Compiling Dart AOT Runtime Currently the application supports only Android libapp.so arm64 only. Also the application is currently work only against recent Dart versions. For high priority missing features, see TODO Environment Setup...

dae

dae 简体中文 Config-driven Dart AOT snapshot analyzer and debug-info exporter. No Dart SDK, never runs the target: locates the embedded snapshot inside Mach-O / ELF / PE, exports the same symbols and structs as blutter for IDA / radare2 / Frida with six deliberate corrections where the reference it w...

Doldrums

To flutter: to move in quick, irregular motions, to beat rapidly, to be agitated. Doldrums: a period of stagnation. Doldrums is a reverse engineering tool for Flutter apps targetting Android. Concretely, it is a parser and information extractor for the Flutter/Dart Android binary, conventionally...

react2shell_analyzer

React2Shell Analyzer A powerful HTTP proxy analyzer for inspecting Next.js Server Actions traffic between your browser/PoC and Next.js server. GitHub Repository https://github.com/Benrich127N/react2shellanalyzer.git Features 🔍 Header Inspection : Logs all request and response headers 📦 Multipart...

CVE-2020-35669

CVE-2020-35669 dummy server please run dummy server using 1st terminal sudo nc -l 127.0.0.1 80 apply given diff diff --git a/main.dart b/main.dart index 8c78291..a46f4d0 100644 --- a/main.dart +++ b/main.dart @@ -4,7 +4,7 @@ import 'package:http/src/request.dart'; void main async var r = Request...

Azure-AD-Incident-Response-PowerShell-Module

Azure AD Incident Response PowerShell Module The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team DART, to assist in compromise response. Why u...

CVE-2026-85493

A flaw was found in Apache Thrift's Dart and Java ME bindings. A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests that trigger excessive recursion. This condition can exhaust system resources and crash the application, resulting in a Denial of Service Do...

CVE-2026-94648

A flaw was found in Apache Thrift. The Dart bindings fail to properly restrict or throttle resource allocation when processing incoming requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, causing excessive resource consumption that lea...

SUSE CVE-2026-94648

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

PT-2026-111679

Name of the Vulnerable Software and Affected Versions Dio versions 1.0.0 through 2.7.9 Description The dio http2 adapter follows redirects in the Http2Adapter. fetch function by copying the original RequestOptions.headers into the redirected HTTP/2 request without verifying if the source and...

blutter

Blutter Herramienta de ingeniería inversa de aplicaciones móviles Flutter mediante la compilación del tiempo de ejecución AOT de Dart Actualmente la aplicación solo soporta libapp.so de Android solo arm64. Además, la aplicación actualmente solo funciona contra versiones recientes de Dart. Para...

BIT-THRIFT-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-85493 Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109190

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109213

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-85493

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgra...

Linux Distros Unpatched Vulnerability : CVE-2026-94633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affect...