PyExfil

PyExfil Stress Testing Detection & Creativity PyExfil was born as a PoC and kind of a playground and grew to be something a bit more. In my eyes it's still a messy PoC that needs a lot more work and testing to become stable. The purpose of PyExfil is to set as many exfiltration, and now also...

crypter

Crypter This Crypter is written in python 3, which can be used to obfusticate, encrypt the python source code to bypass AntiVirus. Also Capable to Bypass VM such as VirtualBox, VMware, Sandboxie. Uses AES-256 bit Encryption & Base64 Encoding to Encrypt the Source Code for Twice. 3 Powerfull Metho...

SigFlip

What is it ? SigFlip is a tool for patching authenticode signed PE files exe, dll, sys ..etc in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data i.e shellcode without breaking the file signature, integrit...

Papers

이 저장소는 제 연구 논문을 호스팅하기 위한 곳입니다. 제 새로운 글을 더 읽고 싶으시다면 이 저장소를 Watch로 등록해 주세요. XSS 탐지 메커니즘 우회 PDF 다운로드 텍스트의 언어 정보를 계산하기 위한 음성적 접근법 PDF 다운로드...

invisible_playwright

Free antidetect browser stealth for Playwright: undetected Firefox fingerprint, headless or headed. Python web scraping and captcha bypass. Open source, and it passes every bot detection test. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the...

AMSI-ETW-Patch

AMSI-ETW-Patch 이 저장소에는 AMSI와 ETW를 단일 바이트 패치로 패치하는 방법에 대한 정보가 포함되어 있습니다. 패치 자체가 단일 바이트이므로 패치 자체의 탐지를 제한하는 것이 아이디어였습니다. AMSI patch-amsi-x64.c 핵심은 AMSI가 중요한 AMSI "검사" 코드에 도달하기 전에 많은 유효성 검사를 수행한다는 것입니다. jz 하나를 jnz로, 그 반대로 간단히 토글할 수 있습니다. 위 그림의 빨간 화살표는 중요한 코드가 위치한 곳을 나타냅니다. 중요한 코드를 호출하지 않도록 토글할 수 있는 검...

avpass

AVPASS AVPASS — это инструмент для утечки модели обнаружения систем детектирования вредоносных приложений Android т.е. антивирусного ПО и обхода их логики обнаружения с использованием утекшей информации в сочетании с методами обфускации APK. AVPASS не ограничивается признаками обнаружения,...

Amsi_Bypass_In_2023

2023년 Windows 11에서의 Amsi 우회 기술적 세부 사항은 다음 기사에서 확인할 수 있습니다: https://medium.com/@gustavshen/bypass-amsi-on-windows-11-75d231b2cac6 AttackAmsiOpenSession.ps1 root@kitploit: HRESULT AmsiOpenSession in HAMSICONTEXT amsiContext, out HAMSISESSION amsiSession ; 이 PowerShell 스크립트는 AmsiOpenSession을 패치하여...

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 where "GTG" stand...

SpookFlare

SpookFlare SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. SpookFlare is a loader/dropper generator for Meterpreter, Empire, Koadic etc. SpookFlare h...

CVE-2026-31431-detection-defense

CVE-2026-31431: 기존 탐지를 우회하는 iouring에 대한 탐지 및 방어 저자 : fz0x00, qiwuSEC 연구 CVE-2026-31431"Copy Fail"에 대해, 우리는 세 가지 우회 전략을 결합하여 주류 보안 제품의 체계적인 취약점을 입증했습니다: iouring 비동기 I/O 경로 , 프로세스 분할fork + SCMRIGHTS , 그리고 소켓 재사용. 실증 테스트를 통해 이러한 기법이 사실상 모든 syscall 기반 탐지 도구를 회피할 수 있음을 증명했습니다. 주요 발견 사항 1. iouring은 사실상...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-58646

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-64796

CVE-2026-64796 concerns the Joomla Sourcerer extension by regularlabs.com, with multiple code injection vectors. The Free version allegedly lets both the article creator and last modifier execute article PHP without needing Super User privileges; the Pro version reportedly fails to consistently e...

PYSEC-2026-1369 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...

PYSEC-2026-1784 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Summary Using idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity functio...

PYSEC-2026-1788 Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL. Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...

CVE-2025-71373 picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on...