catphish

CATPHISH Generate similar-looking domains for phishing attacks. Check expired domains and their categorized domain status to evade proxy categorization. Whitelisted domains are perfect for your C2 servers. Perfect for Red Team engagements. Installation bundle install Current Algorithms...

CVE-2017-15394

CVE-2017-15394 A URL spoofing flaw has been found in the extensions UI of the Chromium browser 62.0.3202.62. An IDN homograph attack demo in Chromium through extensions. 1. Load unpacked extension into Chrome 2. View extension details and observe lack of punycode Impact An attacker would leverage...

certstreamcatcher

Certstreamcatcher Catching phishing by observing certificate transparency logs. This tool is based on regex with effective standards for detecting phishing sites in real time using certstream and can also detect punycode IDNA attacks such as https://www.ṁyetḣerwallet.com. Phishing Phishing...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

SpookySSL-Scanner

SpookySSL-Scanner SpookySSL CVE-2022-3602 SSLv3 Scanner for Windows, Linux, macOS Turkish Zafiyet Nasıl Oluşuyor? Öncelikle sorun byte boyutunu belirlerken ortaya çıkıyor. Bayt boyutunu belirlerken farkındaysanız NULL yani boş/sıfır değer tanımlanmamış yani bayt uzunluğu sıfır olarak...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.73 packages and security update

Red Hat OpenShift Container Platform release 4.16.73 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CLEANSTART-2026-RT11229 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Important: perl-Net-IDN-Encode

Issue Overview: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no...

catphish

CATPHISH Genera dominios de aspecto similar para ataques de phishing. Verifica dominios expirados y su estado de categorización para evadir la categorización de proxies. Los dominios en lista blanca son perfectos para tus servidores C2. Ideal para compromisos de Red Team. Instalación bundle insta...

CLEANSTART-2026-AW83562 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CVE-2026-87078

A memory leak flaw was found in the XS backend of the Perl Net::IDN::Punycode module part of the Net-IDN-Encode distribution. The decodepunycode function allocates a scalar output buffer before validating the Punycode input. The buffer is released only on the success path, so each of the three...

CLEANSTART-2026-XR10051 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Ubuntu 22.04 LTS : Go vulnerability (USN-8883-1)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8883-1 advisory. It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

USN-8883-1 golang-1.18, golang-1.21, golang-1.24 vulnerability

It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges...

USN-8883-1: Go vulnerability

It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges...

CLEANSTART-2026-DT87219 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the temporal-server package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CVE-2026-19954

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips t...