inside-pegasus

Inside Pegasus: key documents from WhatsApp v. NSO Group A curated set of NSO Group internal documents, product materials and sworn testimony that entered the public record in WhatsApp Inc. and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited , Case No...

vexhub-crawler

VEX Hub Crawler vexhub-crawler is a component of the VEX Hubvexhub that automatically retrieves VEX documents from source repositories. Overview The crawler identifies source repositories from registered PURLs Package URLspurl and copies VEX documents into VEX Hub. This process ensures that VEX H...

archiver-MOTW-support-comparison

Comparison of MOTW Mark of the Web propagation support of archiver software for Windows English | Japanese Background On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet such as email attachmen...

SafeText

SafeText Tool to sanitize text to allow for safe distribution of documents from anonymous sources by removing zero-width characters and homoglpyhs. Individuals attempting to leak an email or other text file face the risk of identification through fingerprinting. Fingerprinting often occurs when t...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...

CVE-2022-30190

CVE-2022-30190 This Repository Talks about the Follina MSDT from Defender Perspective Index About Timeline Understanding the Exploit List of IOCs Detection Strategy Testing and Researching Mitigation Plans References About The bug is a Microsoft Windows Support Diagnostic Tool MSDT remote code...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

vexhub

VEX Hub is a centralized repository that collects and manages Vulnerability Exploitability eXchange VEXvex documents from various open-source software projects. It serves as a comprehensive resource for vulnerability information, helping users and security tools to efficiently access and utilize...

CVE-2022-30190

CVE-2022-30190 Follina Proof of Concept Overview This project demonstrates a proof-of-concept exploit for CVE-2022-30190, also known as "Follina" —a critical remote code execution vulnerability affecting Microsoft Office via the MSDT protocol. The application generates malicious Office documents ...

DDEtect

DDEtect Written by Amit Serper, @0xAmit DDEtector is a simple DDE object detector written in python Currently supports only word DOCX and legacy DOC files Prints the contents of the DDE payloads Note: In some cases DDEtect won't print the entire DDE payload. I'm working on writing a better matchi...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

OneNoteAnalyzer

OneNoteAnalyzer A C based tool for analyzing malicious OneNote documents Description Recently we came across few malicious OneNote Documents been distributed in-the-wild by various threat actors. This gave us an idea to develop "OneNoteAnalyzer" which would help in analysing such malicious OneNot...

CVE-2021-40444

EXP Ladon CVE-2021-40444 Office Vulnerability Exploitation Vulnerability Overview On September 8th Beijing time, NSFOCUS CERT monitored that Microsoft released a security advisory disclosing the Microsoft MSHTML remote code execution vulnerability. Attackers can craft malicious ActiveX controls f...

RTF-Cleaner

RTF-Cleaner RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically. Use this tool to statically find URLs in obfuscated RTF documents. Usage: .\rtfCleanerUniversal.ps1 path-to-file Example: .\rtfCleanerUniversal.ps1 'C:\Users\yams\Downloads\invoiceForYams.doc' If the built in...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

Office-Malware-Forensics-Lab-REMnux-Static-Analysis

Office Malware Forensics Lab — REMnux Static Analysis Static analysis of two malicious Office files, done entirely inside an isolated REMnux VM. Nothing was ever executed — just inspected. Setup REMnux VM, no shared folders with the host Tools: sha256sum, file, unzip, and the oletools suite oleid...

MSHTMHell

MSHTMHell: Malicious document builder for CVE-2021-40444...

EUVD-2026-98043

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common...

EUVD-2026-98014

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role...