kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

python-ecdsa

純Python製 ECDSA および ECDH これは、ECC（楕円曲線暗号）の使いやすい実装です。 ECDSA（楕円曲線デジタル署名アルゴリズム）、 EdDSA（エドワーズ曲線デジタル署名アルゴリズム）、および ECDH （楕円曲線ディフィー・ヘルマン）をサポートし、純粋な Python で実装され、 MIT ライセンスで公開されています。このライブラリを使用すると、鍵ペア（署名 鍵と検証鍵）をすばやく作成し、メッセージに署名して、署名を検証できます。また、 交換した公開鍵に基づいて共有秘密鍵に合意することもできます。 鍵と署名は非常に短いため、取り扱いが容易で、...

paramiko

|version| |python| |license| |ci| |coverage| .. |version| image:: https://img.shields.io/pypi/v/paramiko :target: https://pypi.org/project/paramiko/ :alt: PyPI - Package Version .. |python| image:: https://img.shields.io/pypi/pyversions/paramiko :target: https://pypi.org/project/paramiko/ :alt:...

machofile

machofile machofile は、マルウェア解析とリバースエンジニアリングに重点を置いた、Mach-Oバイナリファイルを解析するためのモジュールです。 Ero Carrera の pefile に触発されたこのモジュールは、Mach-Oバイナリに対して同様の機能を提供することを目的としています。 ファイルフォーマットの知識、基本構造、定数の取得に使用された参考資料とドキュメントは、以下のリソースから引用しています。 machofile は自己完結型です。このモジュールに依存関係はなく、エンディアン非依存であり、macOS、Windows、Linux で動作します。 他にも...

flopz

Flopz - Python 기반 펌웨어 해방 Flopz는 순수 Python으로 작성된 어셈블러 툴킷입니다. 다음과 같은 용도로 사용하세요: 임베디드 시스템용 셸코드 생성 대량의 바이너리 동적 패치 디버깅 및 퍼징을 위한 펌웨어 이미지 계측 현재 Flopz가 지원하는 것: ARM: Thumb 모드 PPC: VLE만 RISC-V: RV32I, RV32C IA-32 다른 아키텍처가 구현되길 원하신다면 언제든지 연락 주세요 - 저희는 이 작업을 즐깁니다! Flopz가 keystone, rasm2, gcc 등과 다른 점은 무엇인가요?...

log4py

log4py pythonic 純粋なPython RCEエクスプロイト for CVE-2021-44228 log4shell 1. 脆弱なサービスを実行します（例：https://github.com/zzzz0317/log4j2-vulnerable-spring-app） 2. exploit.py の設定を変更します 3. pwn します これは教育目的のみです（主に自分のためのlol） これはいくつかの変更後にのみ役立つかもしれません 違法なことをしたら - くそくらえ TODO: javac によるコンパイル機能を追加して、より多くのバージョンに対応 他のサービス向けの...

CVE-2026-33936

CVE-2026-33936 ecdsa PyPI におけるサービス拒否 Denial of Service の脆弱性 はじめに 私は python-ecdsa において、Moderate（中程度） の深刻度の脆弱性を特定し、責任ある開示（responsible disclosure）を行いました。python-ecdsa は、先月だけで 4780 万回ダウンロード された広く使われている Python 暗号ライブラリです。 私は python-ecdsa をレビューしているときに、非常に具体的な問いを念頭に置いてこの問題を発見しました。 不正な DER...

EulerOS Virtualization 2.11.1 : protobuf (EulerOS-SA-2026-3454)

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Any project that uses Protobuf Pure-Python backendto parse untrusted Protocol Buffers data containing an arbitrary number of...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

EUVD-2026-54177

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554

CVE-2026-71554 affects the Python HTTP/2 stack in the h2 package. Versions up to and including 4.4.0 accept header blocks containing more than one Host header and forward all Host headers to the application. When a client downgrades HTTP/2 to HTTP/1.1, this can yield two Host header lines, enabli...

UBUNTU-CVE-2026-47180

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.init, causing...

AIOHTTP's unicode processing of header values could cause parsing discrepancies

SummaryThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. ImpactIf a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...

PYSEC-2026-1099 AIOHTTP's unicode processing of header values could cause parsing discrepancies

Summary The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execute a request smuggling...

PYSEC-2026-1104 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

Summary The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker may be able to execu...

PYSEC-2026-1806 protobuf-python has a potential Denial of Service issue

Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits...

protobuf-python has a potential Denial of Service issue

SummaryAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit.Reporter: Alexis Challande, Trail of Bits...

PYSEC-2026-1103 aiohttp allows request smuggling due to incorrect parsing of chunk extensions

Summary The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. Impact If a pure Python version of aiohttp is installed i.e. without the usual C extensions or AIOHTTPNOEXTENSIONS is enabled, then an attacker m...

[SECURITY] Fedora 43 Update: python-mistune-3.2.1-1.fc43

The fastest markdown parser in pure Python, inspired by marked...

[SECURITY] Fedora 42 Update: GitPython-3.1.50-1.fc42

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...