StealthCrypter

💀StealthCrypter💀 📜 Description StealthCrypter is a powerful and easy-to-use encryption tool that helps you protect your sensitive files and directories using AES-256 encryption. Whether you need to safeguard personal documents or secure confidential data, CryptShield ensures that your files remai...

wargame-turkey_in_2

워게임 1. flag 파일 분할 2. 무차별 대입 공격 방지 - 지연 50005초 3. 로깅 4. 비밀번호 해싱 -wargame-turkeyin2...

CVE-2024-42849

CVE-2024-42849 Silverpeas v.6.4.2 및 이하 버전에서 발생하는 문제로, 원격 공격자가 비밀번호 변경 기능을 통해 서비스 거부denial of service를 유발할 수 있습니다. 분석 비밀번호 변경 요청을 가로챈 후 충분히 긴1MB 문자열을 사용할 비밀번호로 제공하면, 비밀번호 해시 처리 시도로 시스템 리소스가 과부하되어 DoS가 발생합니다. 개념 증명PoC/재현 단계 1. 1MB 길이의 문자열을 생성합니다. 2. Burpsuite 또는 유사한 도구를 사용하여 요청을 가로챈 후 Intruder로 보내고...

macOSTriageCollectionScript

macOSTriageCollectionScript macOS用のトリアージデータ収集スクリプトです。sysdiagnoseを利用し、いくつかの追加機能を加えて、調査に役立つトリアージデータを収集します。 このスクリプトは何を収集するのか？ 収集されるデータには以下が含まれます： sysdiagnose ：macOS/iOSオペレーティングシステムの各種バージョンに搭載されているユーティリティで、「システム全体の診断情報」を収集します。ここでは主に、収集されるログファイルとライブデータに使用されます。...

WTSRM

WTSRM - 私のトークに対応するWriting Tiny Small Reliable Malwareデモリポジトリ \KnownDlls\を使用してすべてのWindows DLLのフックを解除 CRT依存なし サイズが小さい 低エントロピー ランダムな文字列暗号化キー（そのため平文の文字列は存在しない） APIハッシュ化 フック検出 ntdll上の初期アンフックのためにフックを迂回する...

hmac-bcrypt

hmac-bcrypt このリポジトリには、hmac-bcrypt パスワードハッシュ関数のリファレンス実装が複数の言語で含まれています。各リファレンス実装は、可能な限り @epixoip によって作成されたオリジナルのCおよびPerl実装の1:1ポートとなることを試みており、相互に完全に互換性があります（つまり、同じハッシュ値を生成・検証します）。 インターフェース 各リファレンス実装は、以下の擬似プロトタイプを持つ2つの手続き型関数を定義しています。 string hmacbcrypthashpassword, settings?, pepper? boolean...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the cachesalt field across multiple API protocol handlers Anthropic, OpenAI chat completion...

CVE-2026-100647

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

EUVD-2026-87741

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

cctv

CCTV — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン CVE-2024-51482 を悪用した ZoneMinder の SQL インジェクションにより、データベースから bcrypt ハッシュが漏洩する。hashcat でクラックすると SSH アクセスが得られる。ポートフォワーディングで露出した内部の motionEye インスタンスは CVE-2025-60787 に脆弱であり、root シェルを取得できる。 列挙 root@kitploit: nmap -sV -sC 10.129.53.160 -Pn...

CVE-2026-81946

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

EUVD-2026-82992

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) uses MD5-based password hashing in firmware versions prior to 1.2412b260707 (V1) and 2.2412b260519 (V2). Because MD5 is a cryptographically weak algorithm, an attacker who obtains the device configuration file can recover the privil...

CVE-2026-81946: Stack-based Buffer Overflow

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-54578 mport verify can compare stale checksum data after hashing failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mportverifypackage in libmport/verify.c could continue after MD5File or SHA256File failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...