Fortinet-PoC-Auth-Bypass

Fortinet-PoC-Auth-Bypass Bash Proof of Concept PoC for Fortinet Authentication Bypass - CVE-2022-40684 Usage: Usage: ./poc.sh Example: ./poc.sh 10.10.10.120 8443 Available in Exploit-db: https://www.exploit-db.com/exploits/51092...

CVE-2022-23131

zabbix-saml-bypass-poc cve-2022-23131 This program is only for internal risk self-inspection by client enterprise users, and is prohibited for any form of unauthorized security testing. fofa: app="ZABBIX-监控系统" && body="saml" Usage: go build -o zexp chmod a+x zexp ./zexp check -t...

labs

Name| Description ---|--- CVE-2015-5531| Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. CVE-2016-1909| Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch...

CVE-2024-5243-pwn2own-toronto-2023

CVE-2024-5243-pwn2own-toronto-2023 TP-Link ER605 Pre-Auth RCE CVE-2024-5242 / CVE-2024-5243 / CVE-2024-5244 Proof-of-Concept PoC exploit chain targeting the TP-Link Omada ER605 DDNS client daemon cmxddnsd when the device is configured to use the Comexe DDNS service. ⚠️ Legal / Ethics : This...

Cisco-IOS-XE-CVE-2023-20198

Cisco-IOS-XE-CVE-2023-20198 Exploit PoC for CVE-2023-20198 Vulnerability information and exploit usage offered by smokeintheshell See references Endpoint, http content type and headers management have been modified from other existing POCs to work in situations in which other exploits fail...

RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. C2 Connection – IP 198.46.86.63 Network analysis reveals that RedLine Stealer establishes a connection to the remote IP address 198.46.86.63. This IP is likely the malware's Command & Control C2 server, used for data exfiltration and command delivery. Key Observations: IP Address: 198.46.86.63...

smtp-tunnel-proxy

📧 SMTP Tunnel Proxy A high-speed covert tunnel that disguises TCP traffic as SMTP email communication to bypass Deep Packet Inspection DPI firewalls. ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌──────────────┐ │ Application │─────▶│ Client │─────▶│ Server │─────▶│ Internet │ │ Browser │ TCP ...

bigip-scanner

BIG-IP Scanner Determine the running software version of a remote F5 BIG-IP management interface. Developed with ❤️ by the Bishop Fox Cosmos team. Description CVE-2022-1388, a critical vulnerability in the F5 BIG-IP management interface, allows an attacker to bypass authentication and remotely...

CVE-2023-25157

Lab CVE-2023-25157 and CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

DVIA-v2

DVIA-v2 Powered by 8ksec.io DVIA-v2 written in Swift along with additional vulnerabilities Damn Vulnerable iOS App DVIA is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration...

xpath

xpath Advanced XPath injection scanner for authorized security testing. Coded by Chokri Hammedi blue0x1 · MIT Licensed Overview xpath is a fast, multi-technique XPath injection scanner written in Nim. It focuses on practical detection, response comparison, visible extraction, blind extraction, an...

GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

GHSA-FCH4-3C6X-J4GC Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...

BFuzz

BFuzz BFuzz is currently in beta. BFuzz is an input based fuzzer tool which take .html as an input, open's up your browser with a new instance and pass multiple testcases generated by domato which is present in recurve folder of BFuzz, more over BFuzz is an automation which performs same task...

GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

CVE-2026-38053---Remove-PPL

CVE-2026-38053---Remove-PPL BYOVD Remove PPL for 24H2 and 25H2 An arbitrary memory write in the handler for IOCTL 0x12C807 METHODNEITHER of Wise System Monitor v1.5.3.127 allows attackers to cause a remove PPL or Denial of Service DoS via a crafted input. Additional Information Tested on: Windows...

GHSA-7VR2-2FGP-9W7P Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...