dref

DNS 리바인딩 공격 프레임워크 이 프로젝트는 더 이상 유지보수되지 않습니다. dref는 DNS 리바인딩의 복잡한 작업을 처리합니다. 다음은 내장 페이로드 중 하나에서 가져온 코드 조각으로, 후킹된 브라우저에서 로컬 서브넷을 스캔하는 데 프레임워크를 사용하는 방법을 보여줍니다. 라이브 웹 서비스를 식별한 후 GET 응답을 외부로 유출하며, 동일 출처 정책을 우회합니다: root@kitploit: // mainFrame runs first async function mainFrame // We use some tricks to...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — クロスポート傍受による同一オリジンポリシー（SOP）バイパス（CVE-2026-20643）...

CVE-2017-17692

CVE-2017-17692 Título do Exploit: SOP Bypass Data: 06 de setembro de 2017 Link do Software: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Autor do Exploit: Dhiraj Mishra Contato: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ Categoria:...

CVE-2026-43735

CVE-2026-43735 Утечка информации между источниками в WebKit. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Принцип Когда родительская страница с помощью запускает фрагментарную навигацию в междоменном iframe, переданное в iframe значение NavigateEvent.sourceElement оказывается тем...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

whonow

Server DNS Whonow Un server DNS malevolo per eseguire attacchi DNS Rebinding al volo. whonow ti consente di specificare dinamicamente le risposte DNS e le regole di rebinding usando le richieste di dominio stesse. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Questa PoC dimostra come un attaccante può concatenare di Orange Tsai CVE-2024-4577 con il DNS rebinding per ottenere l'esecuzione remota di codice sull'infrastruttura di rete interna direttamente tramite il browser della vittima. Bypassando la Same-Origin Policy SOP e...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass the same-origin policy through malicious network traffic. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...