badssl.com

テストサブドメインのリストについては、badssl.com をご覧ください。以下を含みます： self-signed.badssl.com expired.badssl.com mixed.badssl.com rc4.badssl.com hsts.badssl.com サーバー設定 標準のUbuntu VM、badssl.com. および .badssl.com. のDNS AレコードをVMにポイントしています。...

hstsparser

HSTS Parser HSTS Parser は、Firefox および Chrome の HSTS データベースを実際に役立つフォレンジックアーティファクトに解析するシンプルなツールです！ このツールの背景にある研究とその可能性については、私のブログで詳しく読むことができます。 インストール HSTS Parser は pip でインストールするか、ネイティブ実行ファイルとして利用できます。 PyPi から すでに Python がインストールされている場合は、pip を使用して HSTS Parser をインストールできます。 root@kitploit: pip install...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

CVE-2019-13498

CVE-2019-13498 漏洞标题：MITM - 缺失HSTS导致凭据窃取和内容篡改 日期：07/10/2019 漏洞作者：Furqan Khan 厂商主页：https://www.oneidentity.com/ 软件链接：https://www.oneidentity.com/products/cloud-access-manager/ 版本：8.1.3 测试环境：Kali Linux , Windows 7 ,Ubantu 16.04 为了进行MITM攻击并窃取用户名、密码和OTP，我们使用了bettercap...

PRISM-AP

PRISM-AP 关于： PRISM-AP 是一个自动化的无线 RogueAP MITM 攻击框架。 功能特性： 易于安装和使用，完全自动化 利用 MANA WiFi 攻击来引诱客户端连接 通过 bettercap 实现部分 HSTS 绕过 拦截并查看所有 HTTP 头、Cookie 和 URL 查看来自客户端的全部 DNS 请求 保存完整的 Wireshark PCAP 文件以便分析 通过 driftnet 保存所有“嗅探”到的图片 向每个 HTTP 请求注入 BeeF 钩子 KALI/DEBIAN 安装： root@kitploit: ./install.sh 配置：...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

sniffly

Sniffly2 Sniffly2 is a variant of Sniffly which abuses HTTP Strict Transport Security headers and the Performance Timing API in order to sniff your browsing history in Chromium-based browsers. Demo Visit http://diracdeltas.github.io/sniffly in Chrome/Chromium/Brave/etc. with HTTPS Everywhere...

sniffly

Sniffly2 Sniffly2 是 Sniffly 的一个变体，它滥用 HTTP Strict Transport Security 标头和 Performance Timing API，以在基于 Chromium 的浏览器中嗅探您的浏览历史。 演示 在 Chrome/Chromium/Brave 等浏览器中访问 http://diracdeltas.github.io/sniffly，并禁用 HTTPS Everywhere。 注意事项： 在移动端或 Firefox 上无法使用 由于混合内容阻止，无法在 HTTPS 下工作。 广告拦截器可能会影响结果 致谢 crbug436451，...

CVE-2024-56344

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

CVE-2024-56344 IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

EUVD-2024-55771

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

CVE-2024-56344

IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 are affected by a failure to properly enable HTTP Strict Transport Security (HSTS) , classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). A remote attacker with no privileges can exploit thi...

CVE-2022-31629-poc

CVE-2022-31629 poc PHP バグレポート テスト方法 インストール root@kitploit: git clone https://github.com/SilNex/CVE-2022-31629-poc cd ./CVE-2022-31629-poc docker-compose up -d テスト https://localhost:8110 : v8.1.10 https://localhost:8111 : v8.1.11 Chrome HSTS の問題 HSTSページで thisisunsafe と入力してください。...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8, iPadOS 14.8, tvOS 15, Safari 15, and watchOS 8. An attacker in a privileged network position may be able to bypass HSTS...

CVE-2026-53624

A flaw was found in the Fiber web framework's helmet middleware. This vulnerability occurs because the middleware incorrectly checks for the HTTPS protocol, preventing the Strict-Transport-Security HSTS response header from being set. This can allow an attacker to bypass security mechanisms,...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

SUSE CVE-2026-53624

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-35145

HCL DFXAnalytics is reported as affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The issue arises because the application’s web responses do not include the Strict-Transport-Security header, potentially allowing an attacker to downgrade to HTTP and perform MITM attacks. ...

CVE-2026-53624

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...