BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 is an encrypted remote administration and C2 framework designed exclusively for educational use, security research, and controlled laboratory environments. The project demonstrates how to build a custom command-and-control server with application-layer...

PQC-Scanner

The PQC Network Scanner is a purpose‑built assessment tool designed to help organisations understand their cryptographic exposure as they transition toward a post‑quantum security posture. Unlike traditional TLS scanners that focus solely on certificate validity or classical cryptographic strengt...

NetSpy

NetSpyC2 NetSpyC2 is a Python-based Command & Control C2 server created for educational purposes, security research, and controlled laboratory environments. The project demonstrates how encrypted client-server communication, session management, and secure file transfer can be implemented at the...

SSH-Weak-DH

About This tool creates SSH connections to a server and goes through different client configurations to check if the server permits a Diffie-Hellman DH key exchange using a weak group. We aim for our tool to help assess SSH servers for weak DH key exchange settings. Please be aware that this tool...

cve-2025-26466-openssh-poc

CVE-2025-26466 OpenSSH SSH2MSGPING DoS PoC 免责声明： 此代码仅供教学目的 和授权安全测试使用。未经授权攻击他人系统属于违法行为。 漏洞 CVE-2025-26466 是 OpenSSH 中的一个预认证拒绝服务（DoS）漏洞，可在密钥交换完成前使 SSH 服务器过载。 技术细节 受影响版本： OpenSSH 9.9p2 之前的版本 类型： 预认证 DoS / 内存泄漏 利用方式： 在加密连接建立之前处理 SSH2MSGPING 数据包 服务器在初始握手期间就接受 SSH2MSGPING 数据包（消息类型 192），而无需存在已认证的连接。这会导致...

formal_np1sec

研究在 n+1sec 的组密钥交换部分中证明组密钥机密性的工作，存在某些限制，例如仅包含 3 个参与者。这项工作由 Alex Balducci 和 Andy Lee 完成。 主要文档是 gkepnormxormsimplifiedwriteup.txt。其中引用了两份“手工证明”文档以及 gkepnormxormsimplifiedcleaned.spthy，后者是 Tamarin 的输入。GKEP3normxormsimplifiedcleanedproof.spthy 是 Tamarin 的输出。 另见 usefulresults.txt...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

camel-pqc-tls

基于 Apache Camel 的后量子 TLS 本仓库包含三个示例，演示了在 Apache Camel 中使用 X25519MLKEM768 混合密钥交换进行 后量子密码学 PQC TLS 1.3 握手 。 X25519MLKEM768 将经典的 X25519 椭圆曲线 Diffie-Hellman 与 ML-KEM-768 （一种基于后量子格的密钥封装机制，NIST FIPS 203）相结合。两种算法同时运行，即使其中一种被破解，安全性也得以维持。 示例 示例| JDK| TLS 提供者| 方法 ---|---|---|--- pqc-ssl-context| JDK 27|...

ECC_Attacks

椭圆曲线密码学的已知攻击 介绍 椭圆曲线简介 密码学中的椭圆曲线 ECC 攻击 ECDH 攻击 生成元的阶太小 生成元的阶是光滑数 生成元的阶几乎是光滑数，且私钥很小 不验证点是否在曲线上 曲线是奇异曲线 曲线是超奇异曲线 曲线是异常曲线 ECDSA 攻击 签名前不对消息进行哈希 在不同签名中重用相同的 k 值 不安全地生成 k 值 不验证生成元是否有效 结论 ECDH 攻击概述 ECDSA 攻击概述 防御这些攻击 参考资料 介绍 近年来，椭圆曲线密码学方法因其高效性和强安全性而变得流行。本文旨在以比当前互联网上已有的资料更清晰的方式介绍这一主题。...

CVE-2025-32433.py

CVE-2025-32433.py 此 Python PoC 模拟 SSH 消息流，包括密钥交换、通道打开和命令请求，以分析服务器行为。它专为受控实验室测试而设计，演示了协议处理、预认证消息处理以及载荷交互，用于研究和防御性分析。...

CVE-2025-26466

CVE-2025-26466 CVE-2025-26466 的 PoC 作者：Fikret Can Gurbuz 使用方法 root@kitploit: python3 poc.py -i -p 步骤如下： 1. TCP 连接到端口 2. 接收服务器横幅（SSH-2.0-OpenSSHX.Xp1） 3. 发送客户端横幅（SSH-2.0-YourClient\r\n） 4. 发送 wrapsshpacketbuildkexinit 5. 接收服务器的 KEXINIT 响应 6. 循环发送 buildping ! 永远不要完成 KEX，因此 pong 响应将无限排队...

DHEater

DHEater DHEater is the proof-of-concept implementation of the DHEat attack CVE-2002-20001. It saturates a server's CPU by enforcing Diffie-Hellman ephemeral DHE or elliptic-curve Diffie-Hellman ephemeral ECDHE key exchange over both TLS and SSH. For further information about the attack visit the...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in wpa

In Hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker who has successfully bootstrapped public keys with another entity using PKEX in the past will be able to subvert future bootstrapping attempts by passively observing the public keys. By...

Astra Linux – Vulnerability in gnutls28

A vulnerability was identified: the response times for malformed ciphertexts in RSA-PSK ClientKeyExchange differ from those of ciphertexts with correct PKCS1 v1.5 padding...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh’s handling of key exchange KEX processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, especially...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange KEX process, a failure in cryptographic functions may lead to a NULL pointer being dereferenced. This issue can cause the client or server to crash...

Astra Linux – Vulnerability in gnutls28

A timing side-channel vulnerability in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be used to recover the key encrypted in the RSA ciphertext across a network, in a Bleichenbacher-style attack. To successfully decrypt the data, the attacker would...