EUVD-2026-95405

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

CVE-2026-107714

A flaw was found in mechanize. The library treats redirects to the same host as same-origin requests without verifying whether the communication protocol scheme or port has changed. A malicious server can exploit this flaw to cause information disclosure by redirecting connections from secure HTT...

CVE-2026-105672

The TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability within the HTTPS JSON API dispatcher on TCP port 443. An attacker located on the adjacent network can exploit this by appending an onboarding-scoped object to a JSON request, effectively bypassing session ve...

CVE-2026-107318

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

EUVD-2026-95261

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

CVE-2026-107318 @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

CVE-2026-107318

The @fastify/reply-from Fastify plugin (versions prior to 12.7.0 ) is vulnerable to improper certificate validation in its built-in HTTPS transports. The root cause is that these transports override the secure default by setting rejectUnauthorized to false, causing the proxy to fail to verify the...

ip-https-tools

ip-https-tools Microsoft DirectAccess에서 사용하는 IP over HTTPS IP-HTTPS 터널링 프로토콜을 위한 도구 모음으로, Teredo 관련 IPv6 패킷을 IPv4 기반 HTTPS 세션을 통해 전송합니다. MS-IPHTTPS 프로토콜 사양 DirectAccess 기술 개요 DirectAccess 요구 사항 DirectAccess 배포 가이드 ip-https-discover.nse 지정된 호스트가 IP-HTTPS를 지원하는지 확인하는 Nmap용 NSE 스크립트입니다. 샘플 출력:...

DoHC2

⚠️ 참고: 이 도구는 더 이상 적극적으로 유지보수되지 않습니다. DoHC2 DoHC2는 Ryan Hanson의 ExternalC2 라이브러리https://github.com/ryhanson/ExternalC2를 DNS over HTTPSDoH를 통한 명령 및 제어C2에 활용할 수 있게 합니다. 이는 널리 사용되는 모의 적성 시뮬레이션 및 레드 팀 운영 소프트웨어인 Cobalt Strikehttps://www.cobaltstrike.com를 위해 제작되었습니다. 발표 이 프로젝트는 2018년 10월 23일 Mitre...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

trajan

Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan parses workflow YAML files, builds dependency graphs, runs...

goproxy

GoProxy GoProxy は、Go（別名 Golang）を使って カスタマイズ可能な HTTP/HTTPS プロキシサーバー を作成するためのライブラリで、設定可能なオプションがいくつか用意されています。 このプロジェクトの目標は、ある程度のトラフィックを処理できる 最適化された プロキシサーバーを提供しつつ、カスタマイズ可能 で プログラム可能 なものにすることです。 プロキシ自体は単なる net/http ハンドラなので、その上に複数のミドルウェア（パニックリカバリ、ロギング、圧縮など）を追加できます。また、他の任意の HTTP ネットワークライブラリと簡単に統合できます。...

proxy2

proxy2 単一のPythonスクリプトで動作するHTTP/HTTPSプロキシ Features カスタマイズが簡単 外部モジュール不要 IPv4とIPv6の両方をサポート HTTP/1.1永続接続をサポート HTTPS傍受のための動的証明書生成をサポート このスクリプトはPython 2.7で動作します。 HTTPS接続を傍受するにはOpenSSLのインストールが必要です。 Usage スクリプトとして実行するだけです: $ python proxy2.py 上記のコマンドはlocalhost:8080でプロキシを実行します。...

CVE-2026-52102-PoC

CVE-2026-52102 - エクスプロイトPoC CVE-2026-52102 を実証する Proof of Concept PoC。 使用方法 python3 CVE-2026-52102-PoC.py ターゲット targets.txt ファイルに1行につき1つのターゲットを追加します。 注記: 所有しているシステム、または明示的なテスト許可を得たシステムのみを含めてください。 例: https://example.local:8090... https://192.168...:8090... 研究者 名前| LinkedIn ---|--- Rafael Romão|...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more matur...

hoaxshell

hoaxshell ⚡ The latest version of this project is the HoaxShell standalone listener which comes with refreshed payload templates. Wou can also use it directly from https://revshells.com make sure to choose hoaxshell as the listener. ⚠️ As of 2022-10-18, hoaxshell is detected by AMSI...

ProxySqlMap

ProxySqlMap 프록시에서 SqlMapApi로 사용 방법: config.py 수정: 1. Extfilter는 필터링할 확장자입니다. 2. sqlmap은 SQLmap 주소입니다. 3. url은 가로챌 URL입니다. 4. admintoken은 sqlmap의 adminid입니다. 프록시 설정: 127.0.0.1:8081 지원 라이브러리: 1. requests 2. baseproxy이미 내장되어 있어 설치할 필요가 없습니다 HTTPS 지원: baseproxy.ca에 접속하면 다운로드할 수 있습니다. 출력: sqlsan.txt는...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

reproxy

Reproxy is a simple edge HTTPs server / reverse proxy supporting various providers docker, static, file, consul catalog. One or more providers supply information about the requested server, requested URL, destination URL, and health check URL. It is distributed as a single binary or as a docker...

ddoor

ddoor 크로스 플랫폼 DNS TXT 레코드 기반 백도어 ddoor란 무엇인가? ddor는 TXT 레코드를 사용하여 감염된 시스템에서 명령을 실행하는 크로스 플랫폼 경량 백도어입니다. 특징 단일 TXT 레코드로 Linux와 Windows 시스템 각각에 별도의 명령을 지정할 수 있음 약 10개의 공개 DNS 서버 목록에서 무작위로 선택 예측 불가능한 콜백 시간 사용자 지정 암호로 XOR을 사용해 TXT 레코드 암호화 DNS over HTTPS 지원 Keith@keharv님께 감사드립니다! Linux 기능: 안티 디버깅:...