badecparams

BADECPARAMS Prova de Conceito para CVE-2020-0601. badecparams.py gera uma autoridade certificadora intermediária que explora a vulnerabilidade e emite certificados Authenticode e TLS. Os certificados TLS possuem Validação Estendida no Microsoft Edge e Internet Explorer. httpd.py serve o conteúdo ...

CVE-2025-53770

Exploit RCE SharePoint ToolPane Kit di ricerca sulla sicurezza per testare le vulnerabilità di SharePoint ToolPane Panoramica • Funzionalità • Per iniziare • Utilizzo • Struttura del progetto Questo repository contiene proof-of-concept di exploit e strumenti di analisi per la vulnerabilità...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

TeleKiller

. / |U| / \ \ | \ /\ |L| \ \ | /| | / | \ / / |T| | | | /| | | | | | | | | / / |R| | | | | | | | | | | | | | | |A| | | | | | | | | | | | | | \ \ |S| | | | | | | \ | | | /| /| /\ | / \ \ |E| | /| /| /| \ // / |/ / |C| / //|/ / '--8--' 8 O TeleKiller Ein Tool für Session-Hijacking und Stehlen lokal...

cve-2020-1337-poc

cve-2020-1337-poc CVE-2020-1337 के लिए PoC Windows प्रिंट स्पूलर विशेषाधिकार उन्नयन उन सभी शोधकर्ताओं को श्रेय जिन्होंने इस बग का पता लगाया। संदर्भ: https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/ कोड यहाँ से लिया गया: https://github.com/sailay1996/WerTrigger...

pulsar

PULSAR Apprendimento di protocolli, simulazione e fuzzing stateful Pulsar è un fuzzer di rete con capacità automatiche di apprendimento e simulazione di protocolli. Lo strumento consente di modellare un protocollo attraverso tecniche di apprendimento automatico, come clustering e modelli di Marko...

Evilginx-Phishing-Infra-Setup

Guida all'Infrastruttura per Engagement di Phishing Nota: Queste sono copie delle mie note personali. Per favore, non fare completo affidamento su di esse. Indice Blog/Interventi Automazione Infrastruttura Red Team/Phishing Acquisto Domini e Tecniche di Categorizzazione Migliorare la Scrittura di...

awesome-rust-security

Awesome Rust Security Elenco curato di fantastici progetti e risorse relative a Rust e alla sicurezza informatica Indice Strumenti Sicurezza Web e Cloud Valutazione delle Vulnerabilità Sicurezza Offensiva e Red Teaming Rilevamento delle Minacce e Forensics Crittografia Applicazioni Educativo Libr...

IIS-ShortName-Scanner

IIS Short Name Scanner - 2012-2023 & Ancora Funzionante... Ultima presentazione: Beyond Microsoft IIS Short File Name Disclosure Ultimo post sul blog: https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/ Raccomando a tutti di provare...

lightweight_static_analysis

Analisi statica leggera Questa repo contiene il codice PoC per un talk di ShellCon 2019, "Rolling Your Own: How to Write Custom, Lightweight Static Analysis Tools" slides. In sintesi, questa repo dimostra alcuni esempi concreti di come puoi costruire interessanti analisi statiche usando strumenti...

CVE-2026-54330

CVE-2026-54330 affects the Ceph Object Gateway (RGW) SigV4 verifier in versions prior to 20.2.4 and 19.2.6 . The handler fails to reject requests carrying x-amz-* headers that are absent from the signed header set, unlike AWS S3 which rejects such unsigned headers. An attacker holding a presigned...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

EUVD-2026-67276

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CLSA-2026-1787864241 TuxCare security update for 123 packages (1 CVE)

TuxCare rebuilt 123 packages to address 1 CVE. Fixed in 10.0.31.tuxcare0001...

CVE-2021-21985_PoC

CVE-2021-21985 Codice vulnerabile CLASS/METHODs disponibili, un piccolo esempio a scopo di PoC: com.vmware.vsan.client.services.capability.VsanCapabilityProvider root@kitploit: ../snip getClusterCapabilityData getHostCapabilityData getHostsCapabilitiyData getIsDeduplicationSupported...

sniffly

Sniffly2 Sniffly2 ist eine Variante von Sniffly, die HTTP Strict Transport Security-Header und die Performance Timing API ausnutzt, um Ihren Browserverlauf in Chromium-basierten Browsern auszuspähen. Demo Besuchen Sie http://diracdeltas.github.io/sniffly in Chrome/Chromium/Brave/usw. mit...

RFC-Security-Research

RFC-Security-Research Original-Papier und Hilfsskripte zur Analyse von Sicherheitsaspekten von Internet-RFCs. Übersicht Dieses Repository enthält eine Überprüfung der RFC-Sicherheit im Stil eines RFC geschrieben sowie verschiedene Python-Hilfsskripte, die verwendet wurden, um die für die zugrunde...

CVE-2026-50152

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

CVE-2026-50152 Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...