crypter

Crypter 此加密器使用 Python 3 编写，可用于混淆、加密 Python 源代码以绕过反病毒软件。还能够绕过虚拟机，如 VirtualBox、VMware、Sandboxie。 使用 AES-256 位加密和 Base64 编码对源代码进行两次加密。 3 种强大方法检测是否运行在虚拟机或真实机器上。 免责声明 :computer: 本项目仅出于良好目的和个人使用而创建。 此软件按“原样”提供，不提供任何形式的担保。您自行承担使用本软件的风险。使用者的责任完全由最终用户承担。开发者不承担任何责任，也不对因使用本程序造成的任何误用或损害负责。 功能 跨平台 可使用 AES 256...

AMSI-ETW-Patch

AMSI-ETW-Patch Este repositorio contiene información para parchear AMSI y ETW usando un parche de un solo byte para ambos. La idea era limitar la detección del propio parche, ya que es un solo byte. AMSI patch-amsi-x64.c La idea es que AMSI realiza muchas comprobaciones de validación antes de...

invisible_playwright

Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...

avpass

AVPASS AVPASS es una herramienta para filtrar el modelo de detección de sistemas de detección de malware Android es decir, software antivirus y eludir sus lógicas de detección utilizando la información filtrada junto con técnicas de ofuscación de APK. AVPASS no se limita a las características de...

PyExfil

PyExfil 压力测试检测与创意 PyExfil 最初只是一个概念验证（PoC）和某种游乐场，后来逐渐发展成更有分量的东西。在我看来，它仍然是一个杂乱的 PoC，需要大量工作和测试才能变得“稳定”。PyExfil 的目的是提供尽可能多的外泄技术（现在也包括通信技术），这些技术可能 被各种威胁行为者/恶意软件利用，以绕过各种检测和缓解工具与技术。你可以在官方 GitHub 页面 追踪变更。...

SigFlip

这是什么？ SigFlip 是一款用于修补已进行 Authenticode 签名的 PE 文件（exe、dll、sys 等）的工具，其修补方式不会影响或破坏已有的 Authenticode 签名。换句话说，你可以在不破坏文件签名、完整性检查或 PE 文件功能的前提下，通过嵌入数据（例如 shellcode）来改变 PE 文件的校验和/哈希值。 SigInject 会将 shellcode 加密并注入到 PE 文件的 WINCERTIFICATE 证书表中，加密密钥会打印出来，供基本的 BOF/C/C 加载器（SigLoader）使用。SigInject 会将修改后的 PE...

Amsi_Bypass_In_2023

Bypass de AMSI en Windows 11 en 2023 Los detalles técnicos se pueden encontrar en el artículo: https://medium.com/@gustavshen/bypass-amsi-on-windows-11-75d231b2cac6 AttackAmsiOpenSession.ps1 HRESULT AmsiOpenSession in HAMSICONTEXT amsiContext, out HAMSISESSION amsiSession ; Este script de...

Papers

Este repositorio está destinado a alojar mis artículos de investigación. Ponlo en observación si quieres leer más de mí. Evasión de mecanismos de detección de XSS Descargar PDF Un enfoque fonético para calcular información lingüística en texto Descargar PDF...

SpookFlare

SpookFlare SpookFlare 以不同的视角绕过安全措施，让你有机会在客户端检测和网络端检测中绕过端点防御。SpookFlare 是一个用于 Meterpreter、Empire、Koadic 等的加载器/投递器生成器。它具备混淆、编码、运行时编译和字符替换功能。因此，你可以像大佬一样绕过目标系统的防御，直到它们“学会”SpookFlare 载荷的技术和行为。 混淆 编码 运行时编译 字符替换 修补后的 Meterpreter 阶段支持 被封锁的 powershell.exe 绕过 / | / \ / | |/ / | | /\ | \ | \ \ / | | ' list...

CVE-2026-31431-detection-defense

CVE-2026-31431: Detección y Defensa Contra la Evasión de iouring en la Detección Existente Autores : fz0x00, qiwuSEC Investigación Para CVE-2026-31431 "Copy Fail", demostramos debilidades sistemáticas en productos de seguridad convencionales combinando tres estrategias de evasión: ruta de E/S...

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time:- The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop.- The verification key is...

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

CVE-2026-57229

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. The SMTP Simple Mail Transfer Protocol MIME Multipurpose Internet Mail Extensions parser does not fully reset its state when processing encapsulated...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...

Linux Distros Unpatched Vulnerability : CVE-2026-71855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c...

DEBIAN-CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

UBUNTU-CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...