cdb

Pown CDB Pown CDB est un utilitaire du protocole de débogage Chrome. L'objectif principal de l'outil est d'automatiser les tâches courantes pour aider à déboguer les applications web depuis la ligne de commande et de surveiller et intercepter activement les requêtes et réponses HTTP. Ceci est...

peetch

peetch peetch est une collection d'outils visant à expérimenter différents aspects d'eBPF pour contourner les protections du protocole TLS. Actuellement, peetch comprend trois sous-commandes. La première appelée dump vise à sniffer le trafic réseau en associant des informations sur le processus...

striptls

striptls - proxy d'audit implémentation poc des attaques de délestage STARTTLS Une implémentation générique de proxy TCP et outil d'audit pour effectuer des interceptions ssl/tls indépendantes du protocole et des attaques de délestage STARTTLS sur SMTP, POP3, IMAP, FTP, NNTP, XMPP, ACAP et IRC...

starttls-mitm

starttls-mitm — это mitm-прокси, который прозрачно проксирует и сохраняет как обычный plaintext, так и TLS-трафик. Он использует предоставленные пользователем файл ключа и файл сертификата для подмены удалённых серверов. Пользователь должен явно указать устройству, за которым ведётся перехват...

CVE-2026-102406

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

CVE-2026-102406

A CWE-639 Authorization Bypass in Kibana allows users with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant. Because ownership is not verified before Fleet applies settings from an uploaded package, an attacker can redirect another t...

CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

EUVD-2026-93927

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana...

IIS-Backdoor

IIS-Backdoor В этой статье я объясню, как я разработал руткит для Microsoft Internet Information Services IIS. Вопрос: зачем нужен бэкдор в веб-сервере? Первый очевидный, но бесполезный ответ: потому что можем. Ладно, дадим более разумный ответ. Цель внедрения бэкдора в веб-сервер двойная: Он...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking What is it? An attacker app and a victim app to practice the CVE-2021-33699Task Hijacking vulnerability. Reference https://naro-security.tistory.com/55...

CVE-2026-100725

A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be...

FstHook

FstHook Библиотека для перехвата нативных функций через хукинг KiFastSystemCall Примечание: хукинг KiFastSystemCall работает только на следующих системах: Windows XP Service Pack 3 32-bit Windows Vista 32-bit Windows 7 32-bit...

CVE-2026-79551-Tenda

CVE-2026-79551 Жёстко закодированный закрытый ключ TLS в Tenda CNVD ID: CNVD-2026-25884 Производитель: Tenda Technology Co., Ltd. Продукт: сетевой видеорегистратор NVR4H аппаратная версия CH3V2.1 Прошивка: V27.5.58.6 Класс: CWE-321 — Использование жёстко закодированного криптографического ключа...

CVE-2024-3094

CVE-2024-3094 Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specifi...

PT-2026-107156

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

Cisco ASA URL Redirection to Untrusted Site (CVE-2023-20264)

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 single sign-on SSO for remote access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to intercept the SAML...

impostor

Impostor SMB1-сервер для перехвата NTLMv2-хешей, написанный на C. Цель проекта — реализовать SMB1-сервер в виде конечного автомата, который корректно принимает и обрабатывает запросы клиента, чтобы обмануть его, подводя к завершению NTLM-аутентификации и тем самым раскрывая его собственный...

cve-2019-11477-poc

cve-2019-11477-poc Simple Test 1. Start two VMs one for an SSL server and the other for an SSL client 2. Server Execute the server application cd apps ./server.sh 7000 3. Client Install the required packages sudo apt-get install libmnl-dev sudo apt-get install libnetfilter-queue-dev 4. Client Add...