cargo-fuzz

cargo fuzz Acargo subcommand for fuzzing with libFuzzer! Easy to use! Installation $ cargo install cargo-fuzz Note: libFuzzer needs LLVM sanitizer support, so this only works on x86-64 and Aarch64, and only on Unix-like operating systems not Windows. This also needs a nightly compiler since it us...

atomic-red-team

Atomic Red Team Atomic Red Team™은 MITRE ATT&CK® 프레임워크에 매핑된 테스트 라이브러리입니다. 보안 팀은 Atomic Red Team을 사용하여 환경을 빠르고, 이식 가능하며, 재현 가능하게 테스트할 수 있습니다. 시작하기 명령줄에서 직접 원자 테스트를 실행할 수 있으며, 설치가 필요하지 않습니다. 위키의 Getting started 페이지를 참조하세요. 보다 강력한 테스트 경험을 위해 Invoke-Atomic과 같은 실행 프레임워크 사용을 고려해 보세요. 더 알아보기 Atomic Red...

security-operations-labs

Security Operations Labs 개요 이 저장소는 대학 맥락에서 수행된 방어적 보안 작업을 공개적으로 재현 가능한 형태로 재구성하여 묶어 놓은 것입니다. 핵심은 방법론, 재현 가능한 랩, 검증, 그리고 개발된 조치의 한계에 있으며, 강의 자료 공개가 아닙니다. 포함된 프로젝트 프로젝트| 내용 ---|--- Threat Modeling| STRIDE 분석, MITRE-ATT&CK 매핑, 추상화된 DFD 및 위험 레지스트리 IT-/OT-네트워크 세분화| iptables 기반 Default-Deny 게이트웨이, 로깅 및...

turnstile

Archivo de investigación de Turnstile Código de investigación histórico y notas técnicas. Los lanzadores activos están deshabilitados. La extensión de captura registra metadatos únicamente desde fixtures locales. FO1 HTTP 400 permanece sin resolver. Las capturas privadas, las credenciales, el lib...

The vulnerability of the Python relenv tool for creating reproducible and portable environments is related to insufficient resource control during its existence. This allows a malicious actor to trigger a service failure.

The vulnerability of the Python relenv tool for creating reproducible and portable environments is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...

pentest-confirm-mcp

pentest-confirm-mcp Model Context Protocol MCP server for...

GHSA-8WR5-JM2H-8R4F vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without the signing key can mint a second commit with the same files, author, and date, and a valid signature, GitHub still stamps...

[SECURITY] Fedora 44 Update: helm-4.2.2-1.fc44

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Use Helm to: - Find and use popular software packaged as Helm Charts to run in Kubernetes - Share your own applications as Helm Charts - Create reproducible builds of your Kubernetes applications -...

PT-2026-53227

Name of the Vulnerable Software and Affected Versions WsgiDAV versions prior to 4.3.5 Description The sample MySQLBrowserProvider in wsgidav/samples/mysql dav provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. This occurs within the exists record by...

-Web-Attack-Detection-Lab

!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...

Web-Attack-Detection-Lab

!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-23111 nftables LPE: exposure check and safe lab Def...

exploit-labs

exploit-labs Companion code for the Windows-security blog at...

Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety

Current approaches to LLM adversarial testing suffer from coverage gaps: manual red-teaming does not scale, LLM-as-attacker methods exhibit mode collapse, and gradient-based approaches produce uninterpretable gibberish. We introduce a quality-diversity evolutionary framework that operates at the...

How to Compare the Security of Code Written by Humans to LLM-Generated Code

Large language models LLMs are rapidly transforming how software is created and maintained. Comparing LLM-generated code against human-written standards is essential to determine whether these new tools uphold or erode the security baselines established by professional developers. Yet, we lack a...

The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software

The Resource Public Key Infrastructure RPKI secures the Internet's routing system by defining a complex trust and validation framework for certificates, Route Origin Authorizations ROAs, manifests, and Certificate Revocation Lists CRLs. These mechanisms are specified across dozens of RFCs. This...

Unlocking Apple's Private Cloud Compute: An Analysis of Privacy-Preserving Artificial Intelligence

Many existing Artificial Intelligence AI solutions on mobile devices rely on an extensive collection of sensitive data, raising privacy concerns and often requiring storage for both context and model improvement. Apple's Private Cloud Compute PCC aims to address this by emphasizing mobile device...

FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction

Software vulnerabilities pose critical security threats, with nearly 50,000 CVEs reported in 2025. While Large Language Models LLMs show promise for automated vulnerability detection, three key challenges remain. First, LLM-generated vulnerability reports suffer from high false positive rates and...

LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments

The rapid proliferation of LLM-based autonomous agents in real operating system environments introduces a new category of safety risk beyond content safety: behavior jailbreak, where an adversary induces an agent to execute dangerous OS-level operations with irreversible consequences. Existing...