CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

heartbleed-tools

OpenSSL Heartbleed CVE-2014-0160 vulnerability scanner, data miner and RSA key-restore tools. Author: Einar Otto Stangvik / @einaros / https://hacking.ventures Since the cat is long since out of the bag, and others have begun publishing their tools, I'm putting mine out there too. Hopefully this...

openssl

Welcome to the OpenSSL Project OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations are based on a full-strength general purpose cryptographic library, which...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

tp-link-decrypt

NOTE as of 5 October 2025 this project is now depreciated. Nate Robbins has kindly taken over and added switch decryption - https://github.com/robbins/tp-link-decrypt ====================================================================================================== If you found this tool...

keypair

keypair Generate a RSA PEM key pair from pure JS Usage root@kitploit: var keypair = require'keypair'; var pair = keypair; console.logpair; outputs root@kitploit: $ node example.js public: '-----BEGIN RSA PUBLIC...

rocacheck

rocacheck Le paquet rocacheck est une implémentation Go de l'algorithme de fingerprint de clé qui vérifie si une clé RSA a été générée par le code défaillant d'Infineon et est vulnérable à la factorisation via le Retour de l'Attaque de Coppersmith ROCA / CVE-2017-15361...

Detect-CVE-2017-15361-TPM

Detecta Módulos de Plataforma de Confianza Vulnerables a CVE-2017-15361 Este repositorio proporciona contenido para ayudar a los administradores del DoD a detectar sistemas que tienen un Módulo de Plataforma de Confianza TPM habilitado que es vulnerable a CVE-2017-15361 y es un complemento del...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: root@kitploit: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADM...

ROCA-attack-on-vulnerability-CVE-2017-15361

ROCA-attack-on-vulnerability-CVE-2017-15361 This repository contains the thesis developed for my bachelor's degree in Mathematical Engineering at Polytechnic of Turin. It's a script based on python and sage. The goal of the script is to generate an RSA key, evaluete if it's vulnerable by the ROCA...

EUVD-2026-80047

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-92256

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-92256

Netcore NR255-V router version 1.5.130703 is affected by a sensitive information disclosure vulnerability in the l2tpd_config_show_cgi.c , ipsec_show_cgi.c , and mod_vpn_remote/plan.json read handlers. An attacker with low privileges can query l2tpd_config_show.cgi to expose stored IPsec PSK and ...

CVE-2026-92256 Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-0073

Exploit de omisión de autenticación TLS de ADB CVE-2026-0073 Un escáner de red automatizado y herramienta de explotación para CVE-2026-0073 , una vulnerabilidad en el demonio Android Debug Bridge adbd que permite la ejecución remota de código RCE no autenticada y acceso interactivo a shell a trav...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...

Astra Linux – Vulnerability in Thunderbird, Firefox

When importing an SPKI RSA public key as an ECDSA P-256 key, the key is handled incorrectly, causing the tab to crash. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

MikroTik router flaws allow takeover without a password

CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The...

Vulnerabilities in MikroTik RouterOS

MikroTik has addressed several vulnerabilities in RouterOS. The first vulnerability relates to a flaw in the SSH authentication mechanism, where the exponent of RSA keys was not verified. As a result, attackers can forge RSA signatures and gain unauthorized access via SSH. The second vulnerabilit...

CVE-2026-67276

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...