nowafpls

nowafpls 目录 nowafpls 已记录的 WAF 限制 安装 nowafpls 使用 nowafpls 作者 许可证 nowafpls 大多数 Web 应用防火墙（WAF）在发送请求体时，对其可以处理的数据量存在限制。这意味着对于包含请求体的 HTTP 请求（即 POST、PUT、PATCH 等），通常可以通过简单地在前面添加垃圾数据来绕过 WAF。 当请求被填充这些垃圾数据后，WAF 将处理请求中最多 X KB 的数据并进行分析，但超过 WAF 限制之后的所有内容都会直接通过。 nowafpls 是一个简单的 Burp 插件，它会在 Repeater...

Simple-Polymorphic-Engine-SPE32

简单多态引擎 — SPE32 简单多态引擎（SPE32） 是一个用于加密代码和数据的简单多态引擎。 SPE32 允许你加密任何数据，并为该数据生成唯一 的解密代码。加密算法使用随机选择的指令和加密密钥。 每次生成的解密代码都会有所不同。 在 x86dbg 调试器中查看的多态解密代码 另一种多态代码变异，这次带有垃圾指令 SPE32 特性与状态 SPE32 引擎是一个业余项目，可用于演示什么是多态引擎。我在一段时间前编写了它，但我认为将其公开会是一个好主意。 整个代码是用 32 位汇编语言 为 MASM 编译器 编写的。 特性： 整个代码与位置无关（使用 delta offset 访问数据...

astaroth-deobfuscator

astaroth-deobfuscator 用于反混淆 Astaroth/Guildma 注入器 DLL 的 IDA Python 脚本 在尝试分析近期 Astaroth/Guildma 攻击活动中使用的注入器 DLL 时（感谢 SANS ISC 的这篇日记），我遇到了一个 极其 烦人的混淆手段。 有一个函数（我在下图中将其命名为 timewaster3000）在整个 DLL 中被调用了 1,000 多次（!!!）。该函数将六个硬编码字符串作为参数，外加一个随机的 word。就我目前所知，这个函数本身就是一个毫无实际用途的算术无底洞（除了浪费逆向工程师的时间）。以下是在这些烦人的调用存在...

NOP_Plugin

NOPPlugin 用于在 IDA 中将指令 NOP 掉的插件。 该插件的创建灵感来自 Vidar Stealer（当时我正在尝试去除垃圾字节 / 指令）。 之前： 之后： 使用说明 将 NOPPlugin.py 文件粘贴到 IDA 的 "plugins" 子目录下。 要 NOP 掉指令，只需选中指令并按 "SHIFT+Z"。...

DotNET_XorCryptor

DotNET XorCryptor También puedes prestar atención a un proyecto anterior - NET-MalwareCryptor Este es un empaquetador de ejecutables .NET con cifrado de payload. Úselo solo con fines educativos. ¿Cómo usar? --file path - especificar nombre de archivo --flood - añadir clases basura al archivo...

Astra Linux – Vulnerability in Pypy

Python versions prior to 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1, and 3.7.0 are vulnerable to catastrophic backtracking in the difflib.IS-LineJUNK method. An attacker could exploit this flaw to cause a denial of service. source-iocs-preserved const=ISLINEJUNK...

Your phone called. It needs a cleanup.

Does it sometimes take your phone a few minutes to accomplish one simple task? That can be wildly frustrating. But you’re in luck, because we’ve got a free tool that scans your phone for leftover files, temporary data, outdated caches and helps you clean up all that junk. Introducing our Junk...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the spi microchip-core-qspi driver attempting to transmit junk data when simulating read-only...

CVE-2018-25328

VX Search 10.6.18 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying an oversized string in the directory field. Attackers can craft a malicious input file containing 271 bytes of junk data followed by a return address to execute...

CVE-2018-25328 VX Search 10.6.18 Local Buffer Overflow via Directory Field

VX Search 10.6.18 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying an oversized string in the directory field. Attackers can craft a malicious input file containing 271 bytes of junk data followed by a return address to execute...

MAL-2026-3682 Malicious code in @chahuadev/junk-sweeper-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51 The package's postinstall script package.json line 10: "postinstall": "node install.js" unconditionally fetches a platform-native executable from...

CVE-2016-20037

xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long input strings that exceed buffer boundaries. Attackers can craft malicious command-line arguments with 262 bytes of junk data followed by...

CVE-2017-20226 Mapscrn 2.0.3 Stack-Based Buffer Overflow

Mapscrn 2.0.3 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized input buffer. Attackers can craft a malicious buffer with junk data, return address, NOP instructions, and shellcode to overflow the stack and achieve...

CVE-2016-20037 xwpe 1.5.30a-2.1 Stack-based Buffer Overflow

xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long input strings that exceed buffer boundaries. Attackers can craft malicious command-line arguments with 262 bytes of junk data followed by...

PT-2026-27360

Name of the Vulnerable Software and Affected Versions River Past Cam Do version 3.7.6 Description A local buffer overflow exists in the activation code input field. A local attacker can execute arbitrary code by providing a malicious activation code string. This is achieved by crafting a buffer...

CVE-2026-3419

Fastify incorrectly accepts malformed Content-Type headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1https://httpwg.org/specs/rfc9110.htmlfield.content-type. For example, a request sent with Content-Type: application/json garbage passes validation and ...

CLSA-2026-1771926895 python: Fix of 2 CVEs

CVE-2018-1060: fix catastrophic backtracking in APOP method, prevent denial of service, add input validation and enforce backtracking limits - CVE-2018-1061: fix catastrophic backtracking in the difflib.ISLINEJUNK method...

python: Fix of 2 CVEs

CVE-2018-1060: fix catastrophic backtracking in APOP method, prevent denial of service, add input validation and enforce backtracking limits - CVE-2018-1061: fix catastrophic backtracking in the difflib.ISLINEJUNK method...

CLSA-2026-1771927168 python: Fix of 2 CVEs

CVE-2018-1060: fix catastrophic backtracking in APOP method, prevent denial of service, add input validation and enforce backtracking limits - CVE-2018-1061: fix catastrophic backtracking in the difflib.ISLINEJUNK method...

Trend Micro Cleaner One Pro Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Cleaner One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Junk...