BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 es un framework de administración remota y C2 encriptado diseñado exclusivamente para uso educativo, investigación de seguridad y entornos de laboratorio controlados. El proyecto demuestra cómo construir un servidor de comando y control personalizado con...

Matroschka

Матрёшка Acerca de Matroshka es una herramienta de esteganografía de línea de comandos escrita en Python puro. Puedes usarla para ocultar y cifrar imágenes o texto en los bits menos significativos de los píxeles de una imagen. Cifrado El cifrado utiliza HMAC-SHA256 para autenticar los datos...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

scadapack-secure-lock-poc

SCADAPack Secure Lock fixture verifier This repository is a deliberately bounded proof of concept for CVE-2026-81861. It verifies that two controlled fixtures produced with the vendor's shipped Windows DTM can be authenticated and decoded using common key material. It is not an operational exploi...

Grafana-Password-Decryptor

Grafana Password Decryptor Kit de herramientas en Python para descifrar y crackear contraseñas de Grafana en múltiples formatos. Creado por: strikoder ¿Qué Hace Esta Herramienta? Maneja dos tipos de almacenamiento de contraseñas de Grafana: 🔐 AES-256 Base64 tabla datasource → Descifra directament...

CVE-2015-9235_JWT_key_confusion

Descripción Esta aplicación permite reemplazar un valor en un JSON Web Token JWT usando el método HMAC-SHA256 para recalcular la firma. Toma como entrada un token, una clave a reemplazar y el nuevo valor asociado a esa clave. Uso Clona o descarga el código fuente de la aplicación. git clone...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

GHSA-XCW4-53CC-HV32 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

Exploit for CVE-2026-44351

CVE-2026-44351 — Falsificación de JWT por Secret Vacío en fas...

EUVD-2026-76155

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser. Attacker...

CVE-2026-72709

SPIP before 4.4.18 is affected by a missing authorization vulnerability in the administrative action endpoints under ecrire/action/. The root cause is the absence of a server-side permission check via autoriser(): an unauthenticated attacker can obtain a valid HMAC-SHA256 nonce, compute it for an...

CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

Exploit for CVE-2026-81861

SCADAPack Secure Lock fixture verifier This repository is a d...

PT-2026-89912

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF Cross-Site Request Forge...

CVE-2026-81718: Inadequate Encryption Strength

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

PT-2026-79556

Name of the Vulnerable Software and Affected Versions Punk versions prior to 0.18 Description Punk for Perl allows session cookie forgery when a session is declared without a secret. The session keyword does not require a secret or issue a warning when one is absent, causing the cookie read and...

CVE-2026-75870: Use of Default Cryptographic Key

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

EUVD-2026-62350

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...