Http11Probe

Http11Probe Http11Probe 是一个用于 HTTP/1.1 服务器的合规性和安全性测试工具。它通过原始 TCP 套接字向服务器发送畸形、歧义和超大的请求，并根据 RFC 9110 和 RFC 9112 的实际要求检查服务器的响应。这些是严格的解析器和宽松的解析器开始产生分歧的棘手情况，如裸换行符、过时的行折叠、CL/TE 请求走私、分块帧技巧、超大头部和 NUL 字节。 同样的 215 项测试针对用 12 种语言编写的 41 个参考服务器运行，从 Nginx、Apache、Envoy 到 Kestrel、Gin、Actix，以及 Node、Bun 和 Deno...

RFCpwn

RFCpwn 一个使用 SAP RFC 调用的 SAP 枚举与利用工具包 Twitter: @icryo 这是一个用于展示受损服务账户影响的工具包。 此 PoC 不适用于生产环境，不保证稳定性或支持。 RFCpwn 依赖于 pyrfc 以及 SAP 提供的库，详情请参见：https://github.com/SAP/PyRFCinstallation root@kitploit: usage: RFCpwn.py -h -debug -ip IP -u Username -p Password -c Client -s Sysid -ping -enum -usercopy -user...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 are affected by a quadratic time complexity flaw in the addressparser component. When parsing email addresses containing RFC 5322 comments (comment-separated atoms), the parser consumes excessive CPU and blocks the Node.js event loop for several seconds, r...

CVE-2026-90776 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

EUVD-2026-77000

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

KubeStalk

KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. Usage The GIF belo...

subdomain3

Subdomain3 README.md inChinese 中文 Description Subdomain3 is a new generation of tool , It helps penetration testers to discover more information in a shorter time than other tools.The information includes subdomains, IP, CDN, and so on. Please enjoy it. Screenshot medium pattern for speed Feature...

powersap

PowerSAP PowerSAP is a simple powershell re-implementation of popular & effective techniques of all public tools such as Bizploit, Metasploit auxiliary modules, or python scripts available on the Internet. This re-implementation does not contain any new or undisclosed vulnerability. PowerSAP allo...

powersap

PowerSAP PowerSAP 是对所有公开工具中流行且有效的技术（如 Bizploit、Metasploit 辅助模块或互联网上可用的 Python 脚本）的简单 PowerShell 重新实现。此重新实现不包含任何新的或未公开的漏洞。 PowerSAP 允许通过 .Net 连接器 'NCo' 访问 SAP RFC。 致谢 所有功劳归于： Onapsis - Mariano, Jordan… ERPScan @chipik ERPSEC - Joris van De Vis @jvis Chris John Riley @ChrisJohnRiley Agnivesh...

PT-2026-90847

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

AZL-100097 CVE-2026-89537 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

CVE-2026-89537 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

EUVD-2026-76448

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

tls

ztls 用 Zig 编写的 QUIC TLS 1.3 实现，严格遵守 RFC 8446 TLS 1.3 和 RFC 9001 QUIC-TLS。 状态 方面| 信息 ---|--- API 稳定性| 生产就绪 Zig 版本| 0.16.0 平台| Linux、macOS、Windows 性能说明 在 Ed25519 和 RSA-2048 证书配置上已验证了小于 2 毫秒的握手目标。secp256r1 P-256 工作负载当前每次握手运行 2–3 毫秒，原因是上游 Zig stdlib 的限制（PERF-229）。完整决策记录见 ADR-0002。 特性 ✅ 符合 RFC - 实现 TL...

BIT-PYTHON-MIN-2026-17084 stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 the "idna" codec and the intable...

BIT-LIBPYTHON-2026-17084 stringprep.map_table_b2() deviates from RFC 3454 Table B.2

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 the "idna" codec and the intable...

CESS

CESS — Secreto de Shamir Encantado Criptológicamente ¿Esto es basura o chapuza de IA? Un criptógrafo o implementador serio que revise CESS normalmente abrirá vectors/ y testdata/ antes de leer prosa. El conjunto de pruebas es la prueba de trabajo: codifica conocimiento de dominio que no puede...

RFC-Security-Research

RFC-Security-Research Documento original y scripts auxiliares para ayudar a analizar los aspectos de seguridad de los RFC de Internet. Descripción general Este repositorio alberga una revisión de la seguridad de los RFC redactada al estilo de un RFC, además de varios scripts auxiliares de Python...

MUT-BC-SS-01

MUT-BC-SS-01：针对 OpenSSL 中 X.509 BasicConstraints 的变异测试 概述 本仓库实现了一个针对 OpenSSL 中 X.509 证书验证行为的规范驱动型变异测试实验。 该实验基于以下变异算子： MUT-BC-SS-01 该算子修改 BasicConstraints 扩展： root@kitploit: CA:TRUE → CA:FALSE 目标是评估证书验证是否正确地强制执行 RFC 5280 要求，并研究与 CVE-2021-3450 所代表的漏洞类别相关的行为。 仓库结构 root@kitploit: MUT-BC-SS-01/ │ │ ├─...