CVE-2018-14505

mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py...

Free and Open Source Interactive HTTPS Proxy: mitmproxy

mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols. You can prettify and decode a variety of...

Ikraus Anti Virus Remote Code Execution(CVE-2017-15643)

Vulnerability summary The following advisory describes an remote code execution found in Ikraus Anti Virus version 2.16.7. KARUS anti.virus “secures your personal data and PC from all kinds of malware. Additionally, the Anti-SPAM module protects you from SPAM and malware from e-mails. Prevent...

Ikraus Anti Virus 2.16.7 - Remote Code Execution

Ikraus Anti Virus 2.16.7 - Remote Code Execution Vulnerability summary The following advisory describes an remote code execution found in Ikraus Anti Virus version 2.16.7. KARUS anti.virus “secures your personal data and PC from all kinds of malware. Additionally, the Anti-SPAM module protects yo...

McAfee LiveSafe 16.0.3 - Man In The Middle Registry Modification Leading to Remote Command Execution

McAfee LiveSafe 16.0.3 - Man In The Middle Registry Modification Leading to Remote Command Execution Vulnerabilities Summary The following advisory describes a Remote Command Execution found in McAfee McAfee LiveSafe MLS versions prior to 16.0.3. The vulnerability allows network attackers to modi...

Create a Fake AP and Sniff Data: mitmAP

A python program to create a fake AP and sniff data new in 2.0: SSLstrip2 for HSTS bypass Image capture with Driftnet TShark for command line .pcap capture Features: SSLstrip2 Driftnet Tshark Full featured access point, with configurable speed limit mitmproxy Wireshark DNS Spoofing Saving results...

Man-in-the-middle Router

Turn any linux computer into a public Wi-Fi network that silently mitms all http traffic. Runs inside a Docker container using hostapd , dnsmasq , and mitmproxy to create a open honeypot wireless network named “Public”. For added fun, change the network name to “xfinitywifi” to autoconnect anyone...

NagaScan - Distributed Passive Scanner for Web Application

What is NagaScan NagaScan is a distributed passive vulnerability scanner for Web application. What NagaScan do NagaScan currently support some common Web application vulnerabilities, e.g. XSS, SQL Injection, File Inclusion etc How NagaScan work Config a proxy, e.g. Web Browser proxy or mobile Wi-...

pymultitor - Python Multi Threaded Tor Proxy

Did you ever want to be at two different places at the same time? While performing penetration tests there are often problems caused by security devices that block the "attacking" IP. With a large number of IP addresses performing the attacks, better results are guaranteed - especially when...

mitmAP - Simple Tool to Create a Fake AP and Sniff Data

| / \ | \ | | / /\ | |/ / | ' | | | ' | || / | | | | | | | || | | | | | | | || | || || ||||| || || |/| 2.1 A python program to create a fake AP and sniff data. new in 2.0: SSLstrip2 for HSTS bypass Image capture with Driftnet TShark for command line .pcap capture Features: SSLstrip2 Driftnet...

WineBottler 1.8-rc4 Man-In-The-Middle / Code Execution Vulnerability

WineBottler versions 1.8-rc4 and below suffer from a man-in-the-middle vulnerability that can allow for remote code execution. Man in the Middle Remote Code Execution Vulnerability in WineBottler and its Bundles Metadata =================================================== Release Date: 17-10-2016...

mitmproxy kit using the Raiders and customization-bug warning-the black bar safety net

mitmproxy is a support for HTTPSMiTM proxy tool. Different from Fiddler2, and burpsuite, etc. similar function tools, mitmproxy can be in the terminal under the run. mitmproxy in Python development, is to assist the web development&testing, debugging, penetration testing tool. The working princip...

Samsung mobile remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

Summary A remote attacker to completely have the ability to control user web traffic, the manipulation Samsung phone keyboard update mechanism, and on the target phone using the system user permission to execute code. On Samsung devices pre-installed quick keyboard cannot be disabled also cannot ...

Shopify: Lack of SSL Pinning on POS Application ( iOS )

Description Given that this is a POS application and handle CHD, cryptographic security is of most importance. Applications such as Square, Amazons POS, etc. have already implemented this. The iOS application is correctly checking for SSL certs using the os keychain, but due to the lack of checki...

Internet Bug Bounty: HTTP MitM on Flash Player settings manager allows attacker to set sandbox settings

This vulnerability is present in both Google Chrome's PepperFlash aswell as browsers with the NPAPI Flash Player versions. It works by MITM'ing the Flashplayer settings manager. Although this settings manager is served over HTTPS, it is still possible to place or edit the local settings cookie by...

[FS-NyarL] A network takeover & forensic analysis tool

NyarL it's Nyarlathotep, a mitological chaotic deity of the writer HP. Lovecraft's cosmogony. It's represent Crawling Chaos and FS-NyarL it's The Crawling Chaos of Cyber Security :- A network takeover & forensic analysis tool - useful to advanced PenTest tasks & for fun and profit - but use it at...