wp2shell-checker

\ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Checker detector for the WordPress Core REST Batch API pre-auth RCE Created by 0xjessie21 — Cybersecurity ILCS Overview | ---|---...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for...

wp2shell

wp2shell — Pre-Auth RCE in WordPress core Unauthenticated WordPress core RCE PoC chaining CVE-2026-63030 + CVE-2026-60137. Authorized testing only. wp2shell.py is a single-file, standard-library-only proof of concept that chains two WordPress core vulnerabilities into unauthenticated remote code...

crlf-powered-desync-scanner

CRLF-Powered Desync Scanner This is the Burp Extension we used to detect all cases from our research CRLF-Powered Desync Attacks: Beheading HTTP Streams. It's a research-first scanner built using BulkScan similar to HTTP Request Smuggler and others. Implementation Request Header Injection probe...

smuggler

/ | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to Ben Sadeghipour...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

CVE-2022-22536_SAP_Request_Smuggling_Scanner

CVE-2022-22536 SAP Rquest Smuggling Scanner This is a fast, socket-level batch scanner for CVE-2022-22536 , a critical request smuggling vulnerability in SAP Internet Communication Manager ICM and SAP Web Dispatcher. It tests multiple hosts in parallel for protocol desynchronization behavior...

CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free UAF in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal comman...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Credits to @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main for details read: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Tested On Chromium 119.0.6045.123 built on Debian trixie/sid, running on Debian kali-rolling...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

crlf-desyncs

CRLF Desyncs This is a repository containing useful tools and resources for detecting and exploiting CRLF-based Desyncs, presented at BlackHat USA 2026 and DEFCON 34. Contents cdn-origin/ - contains aggregated origin-to-edge headers useful for fuzzing a CRLF injection on a response...

echteeteepee

HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked in local-connectingsockets: it looks up the socket using nfcllcpconnectingsockget, sets...

ASB-A-481967442

In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-93524

A buffer overread in CheckKeySyms in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server...