BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2는 교육용, 보안 연구 및 통제된 실험실 환경 전용 으로 설계된 암호화된 원격 관리 및 C2 프레임워크 입니다. 이 프로젝트는 외부 TLS 스택에 의존하지 않고 애플리케이션 계층 암호화 , 세션 관리 및 안전한 클라이언트 통신을 갖춘 맞춤형 명령 및 제어 서버 를 구축하는 방법을 보여줍니다. ⚠️ 중요 공지 이 프로젝트는 악성코드가 아니며 무단 접근을 위한 것이 아닙니다. BlackBerryC2: 자체적으로 전파되지 않음 자동으로 취약점을 악용하지 않음 지속성...

Matroschka

Матрёшка 소개 Matroshka는 순수 Python으로 작성된 명령줄 스테가노그래피 도구입니다. 이미지 픽셀의 최하위 비트에 텍스트나 이미지를 숨기고 암호화하는 데 사용할 수 있습니다. 암호화 암호화는 HMAC-SHA256을 사용하여 숨겨진 데이터를 인증합니다. 따라서 제공된 MAC 암호는 SHA-256 다이제스트로 해시되어 HMAC-SHA256 키를 생성합니다. MAC과 메시지 데이터는 이미지 데이터에 삽입되기 전에 XTEA 알고리즘CFB 모드, 32회 반복을 사용하여 추가로 암호화됩니다. XTEA 키에 대한...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

Grafana-Password-Decryptor

Grafana 密码解密工具 用于从多种格式解密和破解 Grafana 密码的 Python 工具包。 代码作者：strikoder 该工具能做什么？ 处理 两种类型 的 Grafana 密码存储： 🔐 AES-256 Base64 （datasource 表）→ 使用 AESDecrypt.py 直接解密 🔨 PBKDF2HMACSHA256 （user 表）→ 使用 grafana2hashcat.py 转换为 Hashcat 格式 完美适用于 CVE-2021-43798 路径遍历漏洞的后利用阶段。 什么是 CVE-2021-43798？ 一个存在于 Grafana...

CVE-2015-9235_JWT_key_confusion

영어 설명 이 애플리케이션은 HMAC-SHA256 방식을 사용하여 JSON 웹 토큰JWT의 값을 교체하고 서명을 다시 계산할 수 있게 해줍니다. 입력으로 토큰, 교체할 키, 그리고 해당 키와 연결된 새 값을 받습니다. 사용법 애플리케이션의 소스 코드를 클론하거나 다운로드하세요. root@kitploit: git clone https://github.com/WinDyAlphA/CVE-2015-9235JWTkeyconfusion cd CVE-2015-9235JWTkeyconfusion token.txt 파일에는 예제로 사용되는 유...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

EUVD-2026-62350

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

PT-2026-78315

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

Linux Distros Unpatched Vulnerability : CVE-2026-75589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. Each of the three...

CVE-2026-56360

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

CVE-2026-6291

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

CVE-2026-6291

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

CVE-2026-6291 Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

CVE-2026-6291

Bleichenbacher padding oracle in PKCS7 KTRI decryption. When decrypting PKCS7 EnvelopedData using RSA PKCS1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to...

CVE-2026-7792 WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to and including 1.10.0.1. This is due to the PayPal Commerce webhook endpoint processing unauthenticat...

CVE-2026-45039

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, getsharedsecret in crates/ecstore/src/rpc/httpauth.rs, falls back to...

Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Description The Mailtrap mailer bridge ships a webhook request parser used to authenticate and decode the event callbacks Mailtrap POSTs to an application's webhook endpoint. Its doParseRequest $request, \SensitiveParameter string $secret method receives the configured webhook secret but never...

PT-2026-44547

Name of the Vulnerable Software and Affected Versions Mailtrap mailer bridge versions prior to 7.4 Description The webhook request parser used to authenticate and decode event callbacks fails to verify the X-Mt-Signature HMAC header. Specifically, the doParseRequest $request, SensitiveParameter...