AIS3-2024-Project-D5Team

AIS3-2024-Project-TeamD5 Reappear-CVE-2022-21449-TLS-PoC Before we begin, I would like to thank and pay tribute to some people 1 Neil Madden ; discovered and disclosed CVE-2022-21449, and here is his excellent WriteUp 2 Khaled Nassar ; completed the PoC for easy Demo 3 YuZheng GeGe's Security...

CVE-2024-0710

CVE-2024-0710 Vulnerability: CVE-2024-0710 Unauthenticated Form Submission Unique ID Modification CVSS: 5.3 Medium Software: GP Unique ID gp-unique-id Affected versions: = 1.5.5 Patched version: 1.5.6 Developer: Gravity Wiz Researcher: Karl Emil Nikka, Nikka Systems Publicly published: 2024-04-10...

datadome-vm

DataDome VM Analysis Summary This repository documents the first public version of DataDome's in-browser JavaScript virtual machine VM used in their CAPTCHA/interstitial flow. This analysis covers: Bytecode loading and decoding mechanisms VM memory layout and architecture A proof-of-concept...

Uncensored-AI

Heretic: Fully automatic censorship removal for language models Heretic is a tool that removes censorship aka "safety alignment" from transformer-based language models without expensive post-training. It combines an advanced implementation of directional ablation, also known as "abliteration"...

See-SURF

See-SURF Escáner de seguridad ahora potenciado con IA 🤖 para encontrar posibles parámetros de Server Side Request Forgery SSRF en tu aplicación web. See-SURF no solo te ayuda a detectar posibles parámetros SSRF, sino que también te ayuda a validarlos, protegiendo tu aplicación contra el compromis...

CLSA-2026-1788342969 TuxCare security update for org.springframework (19 CVEs)

TuxCare rebuilt 26 org.springframework packages to address 19 CVEs. Fixed in 6.1.7-tuxcare.3...

Security-Champions

OWASP Security Champions Guide Using MKDocs to host our content next to the OWASP project page on https://securitychampions.owasp.org/. Inspired by https://github.com/OWASP/API-Security and https://github.com/OWASP/Top10/tree/master/2021. Building a local copy on Windows Install python python3 -m...

cve-2022-46718-leaky-location

CoreParsecLocation tl;dr add an entitlement check toparsecd Overview CoreParsecLocation is a sample application demonstrating how a third-party app can access a user's precise location without a user's consent or permission. parsecd/CoreParsec also provides information such as localized search...

Flutter-Reverse-Engineering-Labs

Flutter Reverse Engineering Labs This repository contains a series of progressive challenges designed to introduce the reverse engineering of Flutter applications. Since there aren't many blog posts or tutorials that explain Flutter reversing in detail, I decided to create this repo as a hands-on...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. RustyWater is a Rust compiled executable disguised as reddit.exe with a fake Cloudflare icon known as RustyWater or linked to Archer RAT/RUSTRIC...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

howdy

Howdy proporciona autenticación al estilo de Windows Hello™ para Linux. Utiliza sus emisores IR integrados y su cámara en combinación con reconocimiento facial para demostrar quién es usted. Usando el sistema de autenticación central PAM, esto funciona en todos los lugares donde de otro modo...

checkvulnCVE20205902

checkvulnCVE20205902 A powershell script to check vulnerability CVE-2020-5902 of ip list The instructions there are in the code Keep security!...

CVE-2026-20637-AppleSEPKeyStore-UAF

CVE-2026-20637: AppleSEPKeyStore Use-After-Free CVE-2026-20637 | Author: Johnny Franks @zeroxjf Component: AppleKeyStore Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. —Apple Security Content, iO...

oproxy

oproxy oproxy is a local HTTP, HTTPS, and SOCKS5 proxy for inspecting, replaying, and modifying traffic. It is for developers testing browsers, CLIs, mobile apps, API clients, services, and test suites on their own machine or in a local Docker container. Features Capture HTTP traffic and HTTPS...

cve-2026-31431

CVE-2026-31431 —「Copy Fail」：Linuxカーネル algifaead のローカル権限昇格 CISA KEV | CVSS 7.8 HIGH | Linuxカーネル 4.14〜2026年初頭に影響（約9年間） 目次 1. エグゼクティブサマリー 2. リスク評価 3. 技術的詳細 4. 攻撃手法 — レッドチーム 5. 検知とインシデント対応 — ブルーチーム 6. パッチ適用と修復 7. ラボ環境 8. 参考情報 1. エグゼクティブサマリー CVE-2026-31431 は、通称 「Copy Fail」...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

exploit-CVE-2021-22204

Exploit for CVE-2021-22204 ExifTool - Arbitrary Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description Improper neutralization of user data in the DjVu file format in...

PROMPTPurify

promptpurify Tiny prompt-injection firewall for LLM chat apps. 14 MB. CPU-only. Drop-in guard between your user input and your LLM — runs on the same box, no GPU, no API, no extra service. Built by the SecureLayer7 red-team. Most OSS guardrails are hundreds of MB, want a GPU, and still miss the...

deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...