steganographer

Steganography in Python This script will hide files inside images and save the modified image to disk The maximum size of file which can be hidden inside an image depends on the dimension of the image. maxfilesize = heightofimage widthofimage 6 / 8 bytes '100k words.txt' is hidden in...

Exe2Image

Exe2Image A simple utility to convert EXE files to PNG images and vice versa. Download: https://github.com/OsandaMalith/Exe2Image/releases Screenshots Putty.exe converted to an image...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

Invoke-PSImage

Invoke-PSImage Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute Invoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web. It can...

exfilkit

exfilkit Data exfiltration utility for testing detection capabilities Description Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server ./exfilkit-cli.py -m...

DoodleCloud

DoodleCloud ☁️ Turn Instagram into your personal, infinite cloud storage. DoodleCloud is a Proof-of-Concept PoC tool that uses Instagram's internal API to store unlimited files for free. By converting files into "Visual Noise" images and uploading them as DM doodles, we can bypass file type...

pixload

pixload -- Image Payload Creating tools DESCRIPTION Set of tools for hiding backdoors creating/injecting payload into images. The following image types are currently supported: BMP, GIF, JPG, PNG, WebP. about Useful references for better understanding of pixload and its use-cases: Bypassing CSP...

BobTheSmuggler

BobTheSmuggler Quick Update Jan 15th, 2024 -Support for multi-file compression has been added. If you have multiple files generated for your final payload e.g., DLL-Sideloading files or multi-stage delivery files, you can now use the '-i' option to specify the directory path. If a directory path ...

tweetable-polyglot-png

tweetable-polyglot-png Pack up to 3MB of data into a tweetable PNG polyglot file. See it in action here: https://twitter.com/David3141593/status/1371974874856587268 Other image hosts I've verified this technique to work on: Imgur https://i.imgur.com/kNhGrN3.png Github repo thumbnail/header image...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

CVE-2026-121386

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server or a man-in-the-middle network attacker can cause a Denial of Service DoS by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processi...

EUVD-2026-115918

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer and winprconvertfromjpeg, which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit...

freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server or a man-in-the-middle network attacker can cause a Denial of Service DoS by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processi...

CVE-2026-41216

A flaw was found in vtk. An invalid pointer dereference in the vtkPNGReader component allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PNG image file. When the application attempts to process the malicious file, it crashes unexpectedly...

Linux Distros Unpatched Vulnerability : CVE-2026-121386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer and winprconvertfromjpeg, which lack libpng/libjpeg error...

gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

[SECURITY] [DLA 4874-1] eog security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4874-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 31, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 6601-1] eog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6601-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2026 https://www.debian.org/security/faq -...

glass-cage-i18-2025-24085-and-cve-2025-24201

Original Fork Network Left Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 CVE-2025-24201 – WebKit Remote Code Execution CVE-2025-24085 – Core Media Privilege Escalation Reported to Apple: January 9, 2025 Patched: February–March 2025 Tested On: iPhone 14 Pro Max iOS 18.2.1 CVSS Base Score...