browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

CVE-2026-3854-lab

Flagship Lab 001: From Git Push Options to RCE A local Learning Lab and Research Lab inspired by the publicly documented vulnerability concepts behind CVE-2026-3854. Both experiences use real authenticated Git pushes against ForgeDock, a fictional Git server; the Research Lab. !CAUTION This proje...

talisman

Talisman A tool to detect and prevent secrets from getting checked in Table of Contents What is Talisman? Installation Install onto path recommended approach Installation as a global hook template Configuring a project Using with hook frameworks Pre-commit Husky Directly invoking talisman Upgradi...

terminalphone

TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Research — Windows Push Notifications Use-After-Free Race condition in Windows Push Notifications service WpnService that runs as NT AUTHORITY\SYSTEM. An attacker with local access can trigger a use-after-free during platform shutdown and potentially elevate privileges. CVE:...

GitBackdorizer

GitBackdorizer BETA GitBackdorizer is a proof of concept, fully inspired in Ulisses Castro's 50 ton of backdoors talk, that abuses the lack of user attention to steal git access credentials. How it Works GitBackdorizer consists of three pieces: handler, dropper and the payload. Handler The handle...

PrivExchange

PrivExchange ブログ「Abusing Exchange: One API call away from Domain Admin」に付随するPOCツールです。 必要条件 これらのツールにはimpacketが必要です。pipを使用してpip install impacketでインストールできますが、GitHubから最新バージョンを使用することを推奨します。 privexchange.py このツールはExchange Web Servicesにログインしてプッシュ通知を購読するだけです。これによりExchangeがあなたに接続し、システムとして認証されます。...

CVE-2026-3854-PoC

CVE-2026-3854 PoC — X-Stat Push Option Injection による GitHub RCE 教育目的および許可を得たセキュリティ研究目的のみに使用してください。 明示的な書面による許可なしに、いかなるシステムに対しても使用しないでください。 概要 CVE-2026-3854 は、GitHub Enterprise Server（および GitHub.com）の git push パイプラインにおけるリモートコード実行（RCE）の脆弱性です。 クライアントが push オプション（git push -o）を指定すると、GitHub の内部 Ruby...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass

PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass CWE-863. The deletion guard evaluates @push.user == currentuser || @push.deletablebyviewer. For anonymous pushes, @push.user is nil; for unauthenticated requests,...

CVE-2026-12960

CVE-2026-12960 ASUS Router アプリにおける Android アプリケーションコンポーネントの不適切なエクスポート ASUS Router Android アプリ（com.asus.aihome）に同梱されているコンポーネントは、 android:permission を指定せずに android:exported="true" と宣言されていました。 同じ端末上の他のアプリは、権限を一切保持していなくても、細工した Intent を送信し、 ASUS Router アプリにユーザーに代わって攻撃者制御の URI を開かせることができました。 2026-03-17...

CVE-2026-42978-PoC-Research

CVE-2026-42978 Windows Push Notifications Module for AI Security Tool Next-Gen AI Security Ecosystem, Multi-Protocol Terminal & Autonomous Agent Suite Website · Product docs · Host application · Community chat Website navigation: Home · Updates · Downloads · Modules Official host application...

ghe-push-option-rce-scanner

CVE-2026-3854 — GitHub Enterprise Server RCE via Push Option Injection Overview Improper neutralization of push option values in GHE. Attacker with push access achieves RCE on the instance. Field| Value ---|--- CVE| CVE-2026-3854 Severity| CRITICAL Product| GitHub Enterprise Server CISA KEV|...

mythic_telegram_profile

Mythic用のTelegram C2プロファイル Telegramは、AthenaエージェントおよびApolloエージェント向けのMythic C2プロファイルを提供します。これは、Telegramのプライベートなbot-to-botメッセージをトランスポートとして使用し、MythicのPush C2 gRPCサービスをコントローラーブリッジとして使用します。 アーキテクチャ Athena or Apollo agent bot Telegram Bot API controller bot Telegram C2 service Mythic 実行中の各エージェントは、独自のBot...

hermes-the-messenger

Hermes the messenger A PoC for achieving persistence via push notifications on Windows For more technical details and background read our blogpost here: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Usage Before anything else you need to setu...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: helm-push, k9s, k8sgpt, kube-arangodb, tigera-operator, xeol, flux-helm-controller, maru, cluster-api-helm-controller, kargo, opentofu, gitness, cert-manager-cmctl, helm-set-status, helm-mapkubeapis, kyverno-notation-aws, rancher-helm, manifest-tool...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: helm-push, k9s, k8sgpt, kube-arangodb, tigera-operator, xeol, flux-helm-controller, maru, cluster-api-helm-controller, kargo, opentofu, gitness, cert-manager-cmctl, helm-set-status, helm-mapkubeapis, kyverno-notation-aws, rancher-helm, manifest-tool...

Exploit for CVE-2026-94541

CVE-2026-94541 — WPMobile.App Table of Contents - Execut...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacke...