wifi_db

!Contributorshttp...

Auto_EAP

AutoEAP Introduction Published Sepetember 15, 2016 AutoEAP.py is a script designed to perform automated brute-force authentication attacks against various types of EAP networks. These types of wireless networks provide an interface to facilitate password guessing of domain credentials as radius...

CVE-2026-35330

CVE-2026-35330 strongSwan EAP-SIM / EAP-AKA attribute parser pre-auth heap buffer overflow via integer underflow. Description parseattributes in src/libsimaka/simakamessage.c:419 reads TLV headers whose length byte counts 4-byte words. For the ATRAND / ATENCRDATA branch: if hdr-length 4 in.len ||...

assless-chaps

assless-chaps Crack MSCHAPv2/NTLMv1 challenge/responses quickly using a database of NT hashes Introduction Assless CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response e.g. from a WiFi EAP WPE attack. It requires a database of ...

assless-chaps

assless-chaps 使用NT哈希数据库快速破解MSCHAPv2/NTLMv1挑战/响应 简介 Assless CHAPs 是一种高效恢复 MSCHAPv2/NTLMv1 交换中使用的 NT 哈希的方法，前提是你拥有挑战和响应（例如，来自 WiFi EAP WPE 攻击）。 它需要一个 NT 哈希数据库。下面提供了如何从现有列表或使用 hashcat 搭配字典和规则生成这些数据库的说明。我包含了来自 SecLists 的示例数据库。你需要对其进行 bunzip2 解压。 技术原理 MSCHAPv2 交换不需要破解明文密码，我们只需要使用的 NThash。 MSCHAPv2 将...

weape

wEAPe Script Weape-Wireless-EAP-Extractor ============================================ Extrae automáticamente nombres de usuario EAP 802.1x Desarrollado por Daniel Compton en Info-Assure Ltd https://github.com/commonexploits/weape.git Instalación git clone...

weape

wEAPe Weape-Wireless-EAP-Extractor Script ============================================ Auto extracts EAP 802.1x user names Developed by Daniel Compton at Info-Assure Ltd https://github.com/commonexploits/weape.git Installing git clone https://github.com/commonexploits/weape.git How To Use...

hostapd-mana

hostapd-mana Overview A featureful rogue access point first presented at Defcon 22 by Dominic White @singe & Ian de Villiers @ sensepost [email protected] Documentation Check the wiki for information of getting and using hostapd-mana. Features KARMA/MANA Mode - respond to any device looking...

CVE-2020-8597

CVE-2020-8597 eap.c en pppd en ppp 2.4.2 hasta 2.4.8 tiene un desbordamiento de búfer de rhostname en las funciones eaprequest y eapresponse. Si logras que «EAP: unauthenticated peer name» sea lo suficientemente largo, parece que mi cliente lo limita a 255, puedes hacer un desbordamiento de búfer...

CVE-2022-0853

CVE-2022-0853 CVE-2022-0853 A memory leak on the jboss client side, when using UserTransaction repeatedly. Such as: private void testTransaction throws Exception forint i=1; i 500000; i++ System.out.println"Starting process " + i; // get the UserTransaction and EJB Proxy Context ctx =...

Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true...

codeql-buffer-overflow-variant

codeql-buffer-overflow-variant A deliberately vulnerable, 170-line C program used as a CodeQL static-analysis target. It reproduces the bug class of CVE-2020-8597 — the pppd EAP rhostname stack buffer overflow CWE-120 — in a program that shares none of pppd's function names, call depth, or dispat...

eap_pwn

wpasupplicant y hostapd Copyright c 2002-2022, Jouni Malinen [email protected] y colaboradores Todos los derechos reservados. Estos programas están licenciados bajo la licencia BSD la que tiene la cláusula de publicidad eliminada. Si está enviando cambios al proyecto, consulte el archivo...

CVE-2026-25075-check

CVE-2026-25075 Herramienta de Evaluación de Vulnerabilidad Detecte de forma segura si un servidor VPN strongSwan es vulnerable a CVE-2026-25075 sin causar interrupciones. Consulte el análisis completo en el blog de Bishop Fox. Descripción CVE-2026-25075 es una vulnerabilidad de desbordamiento por...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...