scared

SCAred scared is a side-channel analysis framework maintained by eShard team. Getting started Requirements Scared need python 3.11 , 3.12 or 3.13 and Numpy =2 You can install scared, depending on your setup: from source with pip with conda Install with conda You just have to run: conda install -c...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Combined Covert Channel: CVE-2023-1206 + CVE-2024-49882 Overview This project demonstrates a covert communication channel using two Linux kernel vulnerabilities: Component| CVE| Purpose ---|---|--- Sync Channel| CVE-2023-1206| Clock synchronization via IPv6 hash collision timing Data Channel|...

exploit-cve-2017-5715

Spectre attack Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications...

spectre-attack

Spectre Attack Example Example of using revealed "Spectre" exploit from 2 Jan 2018 CVE-2017-5753 and CVE-2017-5715 Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the...

smiiiiiiiiiiiiiiii

smiiiiiiiiiiiiiiii Exploiting System Management Mode with a very very very very very very very long interrupt. Overview It turns out that you can break SMM — the secure, ultra privileged execution environment running invisibly in the background of every x86 CPU — with nothing more than an obscene...

I-know-where-your-page-lives

I-know-where-your-page-lives I Know Where Your Page Lives: Derandomizing the latest Windows 10 Kernel - ZeroNights 2016 Requirements Intel Processor Haswell or newer Windows 10 x64 Usage Run ASLRSideChannelAttack.exe to get the PML4-Self-Ref entry C:\Users\qa\DesktopASLRSideChannelAttack.exe +...

CVE-2018-3639

CVE-2018-3639 Speculative Store Bypass CVE-2018-3639 proof of concept for Linux Download git clone [email protected]:mmxsrup/CVE-2018-3639.git Build cd CVE-2018-3639 make Run ./specter Output $ ./spectre idx: 0, highest:P, hitrate:21.340000 idx: 1, highest:A, hitrate:15.520000 idx: 2,...

CVE-2026-24516-DigitalOcean-RCE.

CVE-2026-24516-DigitalOcean-RCE. Technical analysis and PoC for CVE-2026-24516: Unauthenticated Root Remote Code Execution in DigitalOcean Droplet Agent CVSS 10.0. TECHNICAL SECURITY ADVISORY: CVE-2026-24516 ID: CVE-2026-24516 TITLE: Unauthenticated Root RCE via Metadata Poisoning & Side-Channel...

CVE-2020-16012-PoC

M2 Project - Side Channel Attack Client Chrome Version 83 Installation Link https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Linuxx64/756066/ Launch command unzip Linux...chrome.zip cd chrome-linux/ ./chrome --disable-gpu --disable-software-rasterizer...

CVE-2026-8794

CVE-2026-8794 — Username Enumeration via Authentication Timing Side-Channel in PaperCut NG Field| Details ---|--- CVE ID| CVE-2026-8794 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-208 — Observable Timing Discrepancy CVSS Score| 3.7 Low — standalone; escalates...

loupe

Loupe Loupe is an iOS and iPadOS app that gives you a hands-on tour of the device fingerprinting surface. It reads real values from public iOS APIs, the same ones any third-party app can call, and shows them to you raw. The point is simple: see what your iPhone quietly exposes, and why each readi...

phywhispererusb

PhyWhisperer-USB What is this thing? This is a hardware trigger for FI or SCA, which triggers on the USB phy. Be sure to read the documentation at http://phywhispererusb.readthedocs.io/ as well! If you are getting started, there are a few demonstration notebooks showing how to: Sniff Data Stream...

sgx-step

A Practical Attack Framework for Precise Enclave Execution Control SGX-Step is an open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX platforms in particular. SGX-Step consists of an adversarial Linux kernel driver and a small user-spa...

CVE-2026-99077

The Linux kernel contains a vulnerability where ICMP Fragmentation Needed and Redirect Message packets only create a FIB nexthop exception (FNHE) if the kernel can match the quoted UDP packet to an existing socket. This behavior enables off-path attackers to perform a side-channel attack on the F...

EUVD-2026-108743

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99076

The Linux kernel is vulnerable to a side-channel attack in the IPv6 implementation. When ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, the kernel previously only created an exception in the IPv6 exception cache if the UDP packet matched an existi...

EUVD-2026-108742

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

file-notification-attacks

File Notification Attacks - Artifacts This repository contains the still in review! artifacts for the paper "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS", accepted at CCS '26. Visit the website with demo...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

pown

Pown Pown.js is a security testing and exploitation toolkit built on top of Node.js and NPM. Unlike traditional security tools, notably Metasploits, Pown.js considers frameworks to be an anti-pattern. Therefore, each feature in Pown is in fact a standalone NPM module allowing greater degree of...