ATFuzzer

ATFuzzer «Opening Pandora's Box through ATFuzzer: Dynamic Analysis of AT Interface for Android Smartphones» ha sido aceptado en la 35.ª Conferencia Anual de Aplicaciones de Seguridad Informática ACSAC 2019. https://syed-rafiul-hussain.github.io/wp-content/uploads/2019/11/atfuzz.pdf Resumen Este...

nautilus

Nautilus 2.0 Nautilus es un fuzzer basado en gramática y guiado por cobertura. Puedes usarlo para mejorar tu cobertura de pruebas y encontrar más errores. Al especificar la gramática de entradas semi válidas, Nautilus es capaz de realizar mutaciones complejas y descubrir casos de prueba más...

pastego

pastego Scrape/Parse Pastebin usando GO e l'espressione grammaticale PEG. pastego.png Installazione $ go get -u github.com/notdodo/pastego Utilizzo Le parole chiave di ricerca sono sensibili alle maiuscole/minuscole pastego -s "password,keygen,PASSWORD" Puoi usare operatori booleani per ridurre i...

t-reqs

T-Reqs HTTP Fuzzer T-Reqs T wo Req uests è un fuzzer HTTP basato su grammatica scritto come parte del paper intitolato "T-Reqs: HTTP Request Smuggling with Differential Fuzzing" presentato ad ACM CCS 2021. BibTeX del paper: root@kitploit: @inproceedingsccs2021treqs, title=T-Reqs: HTTP Request...

xyntia

Indice 1. Installazione 2. Utilizzo 1. Sintetizzare funzioni da file di campionamento 2. Sintetizzare funzioni da un binario 3. Abbreviazioni delle grammatiche 4. Abbreviazioni delle euristiche 5. Regole di inferenza 6. Generare problemi SyGUS 3. Esperimenti 4. Sintetizzare tutti i blocchi da una...

slither

Slither, the smart contract static analyzer Join the Empire Hacking Slack - Discussions and Support Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to...

zeek-mercury-npf

Mercury NPF for Zeek This Zeek plugin implements the Network Protocol Fingerprinting NPF format as specified in the Mercury project. Overview The plugin inspects the following protocols and generates the NPF for them: TCP TLS and DTLS QUIC HTTP SSH OpenVPN requires installation of...

gosentry

gosentry gosentry is a security-focused fork of the Go toolchain, integrating numerous features for state-of-the-art fuzzing campaigns on Go codebases. If you were using go test -fuzz before, you should use gosentry as a replacement. It comes with various fuzzing improvements and bug detectors th...

domato

Domato 🍅 A DOM fuzzer Written and maintained by Ivan Fratric, [email protected] Copyright 2017 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License ...

echidna

Echidna: Ein schneller Smart-Contract-Fuzzer Echidna ist eine seltsame Kreatur, die sich von Bugs ernährt und hochelektrosensitiv ist mit Verbeugung vor Jacob Stanley Um ernst zu sein: Echidna ist ein Haskell-Programm, das zum Fuzzing/propertybasierten Testen von Ethereum-Smart-Contracts entwicke...

PT-2026-82112

Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5 Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to...

umberto

Umberto Umberto è una libreria progettata per mutare dati strutturati generici ad es. JSON, XML, X.509 e un'applicazione a riga di comando che incapsula questa funzionalità. Può applicare una varietà di mutazioni, sintetizzare valori completamente nuovi e applicare mutatori esistenti ad es. Radam...

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression - unnecessarilybracketed - expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow...

CVE-2026-56389

A flaw was found in GNU Bison. During HTML report generation, the software improperly handles grammar-defined configuration variables. An attacker can provide a specially crafted grammar file that overrides the executable used for XML-to-HTML transformation. This allows for the execution of an...

CVE-2026-56390

A flaw was found in GNU Bison. When processing attacker-supplied grammar, the software improperly handles grammar-defined output paths. This allows an attacker to use directives such as %output and %header to specify arbitrary file paths. Consequently, generated files can be directed to any...

SUSE CVE-2026-56390

GNU Bison improperly handles grammar-defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller-supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

AZL-94136 CVE-2026-56390 affecting package bison 3.8.2-1

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

AZL-94133 CVE-2026-56389 affecting package bison 3.8.2-1

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...