OmniSec-Hex

🛡️ OmniSec-Hex OmniSec-Hex is an advanced, high-impact cybersecurity monorepo consolidating six powerhouse client-side security and sovereign intelligence workbanks. Operating entirely within browser-local memory environments with absolute data lockdown, this ecosystem delivers cross-vertical...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2022-22954

Analysis of CVE-2022-22954 Overview Workspace ONE Access workspace delivery as a service model provides multi-factor authentication, single sign-on, and conditional access for SaaS, web, and mobile applications. CVE-2022-22954 is a Server-side Template Injection vulnerability existing in the...

antivmdetection

Antivmdetection Background A script to help you create templates, which you can use with VirtualBox to make VM detection harder. My first post on the subject was in 2012 and have after that been updated at random times. The blog format might have not been the best way of publishing the informatio...

scared

SCAred scared is a side-channel analysis framework maintained by eShard team. Getting started Requirements Scared need python 3.11 , 3.12 or 3.13 and Numpy =2 You can install scared, depending on your setup: from source with pip with conda Install with conda You just have to run: conda install -c...

mmiotic

mmiotic An exploratory tool for MMIO timing — time any physical address, and dissect the hardware off the latency. Unexpectedly useful for hardware reverse-engineering, hypervisor fingerprinting, side-channelling device activity, register characterization, calibrating malicious triggers, and...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

cdf

CDF – crypto differential fuzzing CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approa...

instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...

XFLTReaT

XFLTReaT This is just one thing of many things that was missing from the Internet. If you got tired of trying several tunnelling tools for each protocols, this must be your tool ^W framework. If you are interested in the details, please read the Wiki. Available modules TCP UDP ICMP SOCKS v4, 4a, ...

etherify

Etherify - bringing the ether back to ethernet c 2020 Jacek Lipkowski SQ5BPF [email protected] 2020 RC3 Conference talk: https://www.youtube.com/watch?v=7ek994-fwNE Etherify 1 and 2: https://lipkowski.com/etherify with RPI 4 Etherify 3: https://lipkowski.com/etherify3/ with no ethernet cable...

vm2

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...

CVE-2025-45250

CVE-2025-45250 Suggested description MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie User-Agent: Mozilla/5.0 Windows NT...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

security-research

Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 46 CVEs across 15 projects , 2023 to 2026. Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and...

pphack

pphack Advanced Client-Side Prototype Pollution Scanner Coded with 💙 by edoardottt Share on Twitter! Install • Get Started • Examples • Changelog • Contributing • License Install 📡 Using Go go install github.com/edoardottt/pphack/cmd/pphack@latest pphack relies on chromedp, so you need Chrome or...

TID-The-Instant-Destroyer

TID — The Instant Destroyer Independent security research in the field of protection against cache-based side-channel attacks. Overview TID is a specialized protocol designed to eliminate sensitive data remnants such as cryptographic keys from CPU cache layers $L1, L2, \text and L3$ immediately...

collateral-damage

Collateral Damage Collateral Damage is a kernel exploit for Xbox SystemOS using CVE-2024-30088. It targets Xbox One and Xbox Series consoles running kernel versions 25398.4478, 25398.4908, and 25398.4909. The initial entrypoint is via the Game Script UWP application. The first stage payloads, PE...

duct

Pown Duct Essential tool for finding blind injection attacks using DNS side-channels. Credits This tool is part of secapps.com open-source initiative. / | / | /\ | \ / | \ \ | / | / /\ \ |/// \| || |/ https://secapps.com NB : This tool is taking advantage of http://requestbin.net service...