hcxdumptool

hcxdumptool A tool to capture packets from WLAN devices and to discover potential weak points within own WiFi networks by running layer 2 attacks against the WPA protocol. Designed to run mostly headless on small systems like a Raspberry Pi Zero. hcxnmealog A tool to handle NMEA 0183 sentences fr...

tcpreplay

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...

pico-usb-wifi

= pico-usb-wifi :toc: macro :toclevels: 3 :idprefix: :idseparator: - pico-usb-wifi is firmware for the Raspberry Pi Pico W that turns it into a driverless USB Wi-Fi adapter, enumerating as a USB CDC-NCM device. :figure-caption: AI Slop .pico-usb-wifi Diagram...

nemesis

N E M E S I S - Crafting & Injection The Nemesis Project is designed to be a command line based, portable human IP stack for UNIX-like and Windows systems. The suite is broken down by protocol, and should allow for useful scripting of injected packets from simple shell scripts. The latest release...

pocs_slides

Sharing my advisory, poc, slides and scripts to IoT / protocol security. You can find me at: Medium: https://medium.com/@cq674350529 Blog: https://cq674350529.github.io/ Mail: [email protected] Twitter: @cq674350529 Slides OffByOne2025: Patch Diffing, You Are My Sword! A Deep Dive into Two...

CVE-2021-37152

CVE-2021-37152 Exploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack exploit This exploit is designed for accessing and scanning network clients and you will easily access and prepare for a mitm attack, the exploit will attack in layers three and tw...

CVE-2025-14558

CVE-2025-14558 FreeBSD rtsold DNSSL Command Injection RCE Description rtsold8 does not validate DNSSL domain names for shell metacharacters before passing them to resolvconf8. Command substitution via $ enables remote code execution from an adjacent network. Affected: FreeBSD 13.x, 14.x, 15.x...

lldp

lldp Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB LLDP. C2 data is carried inside Organizationally Specific TLVs Type 127 with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire. LLDP is Layer 2 only. Both agents must share a broadcast...

CVE-2026-119425

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425

OPNsense core versions 26.1.6 through 26.7.7 are vulnerable to an authentication bypass in the captive portal roaming feature. An unauthenticated attacker on the same Layer-2 segment can hijack authorized client sessions by sending forged gratuitous ARP replies . This allows the attacker to bind ...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

PT-2026-133478

Name of the Vulnerable Software and Affected Versions OPNsense core versions 26.1.6 through 26.7.7 Description An authentication bypass exists in the captive portal roaming feature. Unauthenticated attackers on the same Layer-2 segment can hijack authorized client sessions by spoofing...

CVE-2026-119425: opnsense core: OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming…

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-102047

An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent t...

CVE-2026-102051

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...

CVE-2026-102050

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...

CVE-2026-102051 Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...

EUVD-2026-101375

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...

CVE-2026-102051

The l2cpd process in Juniper Networks Junos OS and Junos OS Evolved platforms is vulnerable to an Improper Release of Memory Before Removing Last Reference (CWE-401). An adjacent unauthenticated attacker can trigger l2cpd memory exhaustion and Layer 2 control-plane disruption by sending LLDP traf...