crlf-desyncs

CRLF Desyncs Este es un repositorio que contiene herramientas y recursos útiles para detectar y explotar desyncs basados en CRLF, presentado en BlackHat USA 2026 y DEFCON 34. Contenido cdn-origin/ - contiene cabeceras agregadas de origin-to-edge útiles para fuzzear una inyección CRLF en una...

http-request-smuggler

HTTP 请求走私检测工具 该 Burp Suite 扩展程序能够自动检测并利用 HTTP 请求走私 漏洞，采用由 PortSwigger 研究员 James Kettle 开发的高级去同步技术。它支持对 HTTP/1.1 和 HTTP/2 降级去同步漏洞、客户端去同步以及连接状态攻击进行全面扫描。 2025 年发布的 3.0 版本新增了解析器差异检测功能，可绕过广泛部署的去同步防御措施，从而显著提升有效性。有关此功能的更多信息，请参阅白皮书 HTTP/1.1 Must Die: The Desync Endgame。 该工具完全兼容 Burp Suite DAST、Profession...

http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 - 2014...

http-desync-guardian

概览 HTTP/1.1 从 1991 年到 2014 年经历了漫长的演进： HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 这意味着存在多种服务器和客户端，它们对请求边界的理解可能不同，从而产生反同步攻击（即 HTTP Desync）的机会。 遵循最新的 RFC 建议看似简单。然而，对于已运行多年的大型系统，这可能会带来不可接受的可用性影响。 httpdesyncguardian 库旨在分析 HTTP 请求以防范 HTTP Desync...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler Una herramienta de prueba de HTTP Request Smuggling / Desync escrita en Python 3 Agradecimientos Un agradecimiento especial a James Kettle por su investigación y métodos sobre...

wp2shell

wp2shell — RCE pre-autenticación en el núcleo de WordPress PoC de RCE no autenticado en el núcleo de WordPress que encadena CVE-2026-63030 + CVE-2026-60137. Solo pruebas autorizadas. wp2shell.py es una prueba de concepto de un solo archivo que usa únicamente la biblioteca estándar y encadena dos...

crlf-powered-desync-scanner

CRLF-Powered Desync Scanner Esta es la extensión de Burp que usamos para detectar todos los casos de nuestra investigación CRLF-Powered Desync Attacks: Beheading HTTP Streams. Es un escáner orientado a la investigación construido con BulkScan, similar a HTTP Request Smuggler y otros. Implementaci...

EUVD-2026-76943

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

CVE-2026-90678

HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5 are affected by an HTTP request smuggling vulnerability in the HTTP/3 (QUIC) multiplexer . When an HTTP/3 request with no Content-Length header is forwarded to an HTTP/1.1 backend using chunked transfer coding on a reused connection, the d...

SilentMoonwalk

SilentMoonwalk 完全动态调用栈欺骗器的 PoC 实现 概要 SilentMoonwalk 是一个完全动态调用栈欺骗器的 PoC 实现，它实现了一种技术，用于从调用栈中移除原始调用者， 并使用 ROP 使栈展开与控制流不同步。 作者 本 PoC 是有关栈欺骗主题的联合研究成果。该研究的作者是： KlezVirus Waldo-IRC Trickster0 我想强调，如果没有 Waldo-IRC 和 Trickster0 的工作，这项工作将不可能完成，他们两人都 为 PoC 的早期阶段以及背后的研究做出了贡献。 概述 该仓库演示了一个 PoC 实现，用于在调用任意 Window...

DEBIAN-CVE-2026-90473

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

CVE-2026-90473

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

EUVD-2026-76849

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

CVE-2026-90473

msgpack-java through 0.9.12 is affected by an integer overflow in MessageUnpacker.skipValue() when processing MAP32 containers. An attacker can supply a MAP32 element count of 0x40000000 or greater , which wraps when doubled, causing the parser cursor to desynchronize so that attacker-controlled ...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

致谢 @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main 详情请阅读： https://mizu.re/post/abusing-client-side-desync-on-werkzeug 已在基于 Debian trixie/sid 构建、运行于 Debian kali-rolling 的 Chromium 119.0.6045.123 上测试。...

PT-2026-90636

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

Linux Distros Unpatched Vulnerability : CVE-2026-90473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts...

CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​这个JavaScript有效载荷使用 \alpha 常量来创建一个高频的"Memory Shiver"。它通过在WebKit垃圾回收器与GPU的Metal命令缓冲区之间制造不同步，触发CVE-2025-43529中的Use-After-Free（UAF）漏洞。 🍎 CTT-Apple-Silicon-Refraction WebKit/ANGLE 零日 "标签保护地址；CTT控制时间。" CVE-ID: CVE-2025-14174...

CVE-2026-88052

Tesseract is an open-source OCR engine. In versions 5.5.3 and earlier , the function UNICHARSET::load_via_fgets (in src/ccutil/unicharset.cpp) uses a declared unichar count as a loop bound and indexes into the unichars vector with an unchecked id. Because unichar_insert_backwards_compatible can l...