entropy

Paranoïd about having secrets leaked in your huge codebase? Entropy is here to help you find them! Entropy Entropy is a CLI tool that will scan your codebase for high entropy lines , which are often secrets. Installation From source with Go preferred root@kitploit: go install...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

CVE-2025-51726

As requested, I have now demonstrated both vulnerabilities BA2022 & BA2015 with practical exploitation scenarios and PoC evidence, which shows how an attacker could abuse these issues in a real-world context. 📌 1. BA2022 Weak Hash in Code Signing – SHA-1 Exploitation Demonstration Although the...

AWS-Loot

AWSLoot Searches an AWS environment looking for secrets, by enumerating environment variables and source code. This tool allows quick enumeration over large sets of AWS instances and services. Install root@kitploit: pip install -r requirements.txt An AWS credential file .aws/credentials is requir...

Locky

Locky Locky generates "really" strong yet easy to remember passwords. Passwords generated by Locky have following features: 20+ chars Really high entropy Easy to remember Padding between words Custom element name Hence the passwords can't be bruteforced, can't be guessed and can't be forgotten...

git-all-secrets

git-all-secrets 概要 git-all-secrets は以下のことが可能なツールです： 組織の複数の公開/非公開 GitHub リポジトリをクローンし、スキャンする、 組織に所属するユーザーの複数の公開/非公開 GitHub リポジトリをクローンし、スキャンする、 組織の単一の公開/非公開リポジトリをクローンし、スキャンする、 ユーザーの単一の公開/非公開リポジトリをクローンし、スキャンする、 ユーザーの単一の公開/シークレット gist をクローンし、スキャンする、 組織内のチームのリポジトリをクローンし、スキャンする、 上記すべてを同時に行う！ そうです！...

Pwdb-Public

PWDB - New generation of Password Mass-Analysis Goal Leaving the 20 year old stuff of red team behind. Stuff works fine, and no one bothers to check/replace it through decades. Included dumps You can check the status.txt in this repository to keep track of included dumps. Mystery List of 40k high...

CVE-2026-59941

CVE-2026-59942: Dompdf Resource Exhaustion DoS - Proof of Concept Vulnerability Type: Denial of Service DoS via Resource Exhaustion Affected Software: Dompdf = 3.1.5 Credits: Fabian Rosales far00t01. Disclaimer This repository and its content are provided for educational and research purposes onl...

CVE-2026-18050

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2026-59942

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

PT-2026-63554

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description Dompdf is susceptible to a Denial of Service DoS attack via resource exhaustion. An unauthenticated remote attacker can crash the PHP process by submitting a specially crafted HTML document containing ...

MAL-2026-1234 Malicious code in uxproject11 (npm)

Collects and exfiltrates sensitive system information to suspicious domains. Multiple YARA rules are triggered. High entropy file. Extension mismatch. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b478ab519bbd87949cad8be7d77296e0eddd01aa0be1b4b168ed2f6a0f7413...

Malicious code in uxproject11 (npm)

Collects and exfiltrates sensitive system information to suspicious domains. Multiple YARA rules are triggered. High entropy file. Extension mismatch. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b478ab519bbd87949cad8be7d77296e0eddd01aa0be1b4b168ed2f6a0f7413...

FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization

Test-time personalization in federated learning enables models at clients to adjust online to local domain shifts, enhancing robustness and personalization in deployment. Yet, existing federated learning work largely overlooks the security risks that arise when local adaptation occurs at test tim...

LexiMark: Robust Watermarking via Lexical Substitutions to Enhance Membership Verification of an LLM's Textual Training Data

Large language models LLMs can be trained or fine-tuned on data obtained without the owner's consent. Verifying whether a specific LLM was trained on particular data instances or an entire dataset is extremely challenging. Dataset watermarking addresses this by embedding identifiable modification...

Spill the Beans: Exploiting CPU Cache Side-Channels to Leak Tokens from Large Language Models

Side-channel attacks on shared hardware resources increasingly threaten confidentiality, especially with the rise of Large Language Models LLMs. In this work, we introduce Spill The Beans, a novel application of cache side-channels to leak tokens generated by an LLM. By co-locating an attack...

Crypto-NcRNA: Non-Coding RNA (NcRNA) Based Encryption Algorithm

In the looming post-quantum era, traditional cryptographic systems are increasingly vulnerable to quantum computing attacks that can compromise their mathematical foundations. To address this critical challenge, we propose crypto-ncRNA-a bio-convergent cryptographic framework that leverages the...

PT-2023-26384 · Unknown · Rws Worldserver

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions 11.7.3 and earlier Description: Session tokens in RWS WorldServer have a low entropy and can be enumerated, leading to unauthorized access to user sessions. Recommendations: For RWS WorldServer versions 11.7.3 and...