sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

HiveV5_keystream_decryptor

HiveV5 keystream decryptor PoC Introduction The Hive sample analyzed and referred to in this document was randomly chosen from this list created by @rivitna to which my warmest thanks go. Artifacts are available on the VirusTotal platform. In this document, file a0h2uih3d2.exe has been taken as a...

RSA-Backdoor

RSA Backdoor Generator This repo contains code to reproduce the Secretly Embedded Trapdoor with Universal Protection SETUP attack on RSA key generation proposed by Young & Yung, 1996. Considering the potential of this attack, never trust black box key generation systems. References: - Presentatio...

PGP-Tools

PGP Tools Open-source browser extension for PGP & AGE encryption and decryption. Built with Rust/WebAssembly. Private keys never touch the JS heap unless they have to. !PGP Tools side panel: encrypting a message to a recipient, with signing switched...

debianopenssl

debianopenssl Private keys vulnerable to Debian OpenSSL bug CVE-2008-0166 In 2008 a bug in Debian's and Ubuntu's OpenSSL package led to predictable private keys. While the number of keys is limited, it takes a few considerations to create a proper list of all plausibly affected keys. This...

immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Proof-of-concept cybersecurity demo for CVE-2026-35455, showcasing automated API key generation and data exfiltration leading to full account hijacking and persistent unauthorized access. Learn more: report, video...

keypair

keypair Generate a RSA PEM key pair from pure JS Usage var keypair = require'keypair'; var pair = keypair; console.logpair; outputs $ node example.js public: '-----BEGIN RSA PUBLIC...

SkypeACLKeyGen.exe-analysis-for-hacking-team

SkypeACLKeyGen.exe analysis for hacking team So... what do we analyse today ? well today we analyse a piece of software from hacking team. It's about skype? why do we do this ? idk i find it interesting. So anyway we start by inspecting runtime behaviour. As you can see it requires a username and...

CVE-2022-21449

CVE 2022 21449 python implementation This project allows you to: Plot an elliptic curve with desired parameters, over a finite field or not Generate a key pair from a given elliptic curve Encrypt / Decrypt a message via ECIES Sign / verify using ECDSA Simulate an exploitation of CVE 2022 21449 Fi...

Detect-CVE-2017-15361-TPM

Detect Trusted Platform Modules Vulnerable to CVE-2017-15361 This repository provides content for aiding DoD administrators in detecting systems that have an enabled Trusted Platform Module TPM that is vulnerable to CVE-2017-15361 and is a companion to Information Assurance Advisory RSA Key...

Certificate compromise - eMudhra (CVE-2026-114406, CVE-2026-111943, CVE-2026-111944,CVE-2026-91403, CVE-2026-113812)

Brocade Security has become aware of a critical certificate authority incident disclosed on October 17, 2026, related to eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing...

ROCA-attack-on-vulnerability-CVE-2017-15361

ROCA-attack-on-vulnerability-CVE-2017-15361 This repository contains the thesis developed for my bachelor's degree in Mathematical Engineering at Polytechnic of Turin. It's a script based on python and sage. The goal of the script is to generate an RSA key, evaluete if it's vulnerable by the ROCA...

How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)

Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...

vuke

vuke Herramienta de investigación para analizar y reproducir la generación vulnerable de claves de Bitcoin. Características Arquitectura modular : fuentes y transformaciones conectables Múltiples fuentes de entrada Rangos numéricos probar semillas débiles Listas de palabras análisis de brainwalle...

hdcp-genkey

Esempio di generazione della chiave HDCP Questo script implementa una versione semplice dell'algoritmo di generazione delle chiavi HDCP in Python utilizzando la chiave master HDCP trapelata che si trova in master-key.txt. Usage: generatekey.py options Options: -h, --help show this help message an...

zyxel-vmg8825-keygen

Zyxel VMG8825-T50 Keygen per Supervisor Questo progetto contiene le seguenti funzioni implementate in Python 3: Nome funzione| Validità ---|--- zcfgBeCommonGenKeyBySerialNumCBT | ❓ zcfgBeCommonGenKeyBySerialNumMethod2 | ✅ zcfgBeCommonGenKeyBySerialNumMethod3 | ✅...

Timing Attack

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and...

Rocky Linux 9.6 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787393949)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787393949 advisory. - A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with...

CVE-2026-90562

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...