ForgeCert

ForgeCert ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was...

Bluetooth-Attacks-CVE-2025-27840

This paper discusses how an attacker can introduce a hidden list of vulnerabilities through module updates, which can lead to compromise of ESP32 devices and gaining unauthorized access to private keys, affecting billions of devices using this microcontroller. One of the key issues is the...

CVE-2022-20866

RSA Key Checker for CVE-2022-20866 A vulnerability in the handling of RSA keys on devices running the Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software could allow an unauthenticated, remote attacker to retrieve the RSA private key. This vulnerability is due to a...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program mallory -config path/to/config.jso...

WhatsDump

Rewriting entire project. WIP WhatsDump Extract WhatsApp private key from any Android device Android 7+ supported. This tool spawns a clean Android 6 emulator and attempts to register with your number to extract msgstore private key. NOTE: this tool is in beta stage and might not be stable. You'r...

gpg_reaper

GPG Reaper TL;DR: gpg-agentのキャッシュ/メモリからGPG秘密鍵を取得/盗取/復元する このPOCは、Windows上の gpg-agent メモリからGPG秘密鍵を取得する方法を示しています。 通常、これは 10分 の時間枠（--default-cache-ttl 値）内でのみ可能であるはずです。 残念ながら housekeeping 関数（キャッシュのクリーンアップを担当）は、GPGを使用している場合にのみ実行されます（タイマーはありません）。 つまり、通常のGPG使用例（ファイルに署名し、GUIを閉じて別のタスクを行うなど）では、パスワードは依然として...

RsaCtfTool

RsaCtfTool RSA multi-attack tool that decrypts data from weak public keys and recovers private keys. Overview This tool is a utility designed to decrypt data from weak public keys and attempt to recover the corresponding private key. It offers a comprehensive range of attack options for cracking...

ed25519-unsafe-libs

ed25519-unsafe-libs Double Public Key Signing Function Oracle Attack on Ed25519 A list of potentially unsafe ed25519 signature libraries that allow a public api where secret and public key can be provided independently as signing function inputs. Misuse of these public apis can result to private...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com", "Slack Token":...

JKS-private-key-cracker-hashcat

JKS private key cracker - Nail in the JKS coffin The Java Key Store JKS is the Java way of storing one or several cryptographic private and public keys for asymmetric cryptography in a file. While there are various key store formats, Java and Android still default to the JKS file format. JKS is o...

CVE-2026-8932-PoC

CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026-8932 , an incomplete mTLS configuration matching issue in libcurl connection reuse. Overview CVE-2026-8932 affects libcurl's connection reuse logic when mutual TLS mTLS configuration changes between requests. Under vulnerable conditions,...

CVE-2022-2274

OpenSSL-src Heap Memory Corruption with RSA Private Key Operation : CVE-2022-2274 Summary OpenSSL-src-rust is a source code and logic to build OpenSSL from source written in rust and packaged as a crate. There are currently two maintained branches, matching the two maintained OpenSSL versions whi...

SSH-Private-Key-Looting-Wordlists

LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH Private Key Looting Wordlists 🔒🗝️ This repository contains a collection of wordlists to aid in locating or brute-forcing SSH private key file...

CVE-2014-2734

CVE-2014-2734 Ruby OpenSSL CA Private Key Spoofing ============= Ruby openssl has a vulnerability when a public key is a issued prior writing to private key and is reopened during a script it spoofs a CA private key. PoC script https://gist.github.com/10446549 Mitre:...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

about-hmac

About HMAC An Example Implementation of Basic HMAC Hash-based Message Authentication Code Using Flask in Python. What is HMAC?! Hash-based message authentication code HMAC provides the server and the client each with a private key that is known only to that specific server and that specific clien...

PoC_CurveBall

CVE-2020-0601 - CurveBall Highlights PoC for CVE-2020-0601 Trivial solution for private-key of 1 Non-trivial solution for 1 private-key curve-order Written in C, uses OpenSSL's libcrypto Requirements Linux of some variety apt install libssl libssl-dev Or whatever package mananger you use Compilin...

roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...

curveball

curveball CVE-2020-0601 curveball - 代替鍵計算機 ビルド Windows Visual Studio 2012 以降で、ソリューションをビルドしてください。 Linux / Unix cc altkey.c -lcrypto -o altkey 使用方法 使用方法: altkey ecpubliccertificate.pem ecnewprivatekey.pem 例 C:\security\curveball\Releasealtkey...

CVE-2023-33242

CVE-2023-33242 CVE-2023-33242 PoC The simulated Lindell17 protocol is vulnerable to a bit extraction exploit, allowing an attacker to recover the private key by iteratively extracting individual bits of the key. The protocol is designed to generate ECDSA signatures in a client-server model, with...