Fugu15

Fugu15 Fugu15 is a semi-untethered permasigned jailbreak for iOS 15. It contains a code-signing bypass, kernel exploit, kernel PAC bypass and PPL bypass. Additionally, it can be installed via Safari, i.e. a computer is not required, except for a Web Server that hosts Fugu15. Please note that Fugu...

CVE-2020-0601

CVE-2020-0601 PoC для CVE-2020-0601 - Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall В Kali: 1. Создать PKCS12 файл root@kitploit: openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req -n...

CVE-2018-0114

CVE-2018-0114 Exploit para Node-jose 0.11.0 escrito en Ruby Uso solo ingresa el nombre de la víctima en el código y ejecuta el archivo con ruby ./exploit.rb Una vulnerabilidad en la librería de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto n...

CVE-2025-55234

CVE-2025-55234 Esta vulnerabilidad permite a los atacantes realizar ataques de retransmisión contra el protocolo SMB Server Message Block. Si tiene éxito, puede conducir a una elevación de privilegios EoP, permitiendo esencialmente que usuarios no autorizados obtengan acceso de mayor nivel en un...

MagicSigner

MagicSigner 만료된 인증서로 서명할 수 있게 해주는 signtool용 패처 dll 사용법 XmlLite.dll을 signtool.exe 옆에 두기만 하면 됩니다 데모 MagicSigner 사용 전 MagicSigner 사용 후 대체 솔루션 컴퓨터의 시계를 뒤로 되돌리는 방법도 있습니다. 하지만 이 방법은 관리자 권한이 필요하며, 해당 시점에 TLS 연결예: HTTPS이 사용하는 모든 인증서를 무효화하기 때문에 다른 앱을 손상시키는 경향이 있습니다. 이에 대한 방어 방법 알려진 모든 유출 인증서가 포함된 Microsof...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Una vulnerabilidad en la biblioteca de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto no autenticado vuelva a firmar tokens utilizando una clave incrustada dentro del token. La vulnerabilidad se debe a que node-jose sigu...

CVE-2026-82329-poc

CVE-2026-82329 Artifactory Security Assessment Tool PoC dan alat validasi untuk mengidentifikasi instalasi JFrog Artifactory self-hosted yang terdampak CVE-2026-82329. Alat ini memvalidasi rantai autentikasi berikut: 1. Membuat join JWT HS256 menggunakan signing key default yang kosong. 2. Mengir...

pivit

Pivit Pivit is a command line tool for managing x509 certificates stored on smart cards with PIV applet support Yubikey, and using those certificates to sign and verify data. It is fully compatible with how the git command line calls external programs to sign and verify commits and tags. Install...

hsm

zhsm A Hardware Security Module HSM library for Zig providing PC/SC access to PIV , CAC , and YubiKey tokens. Status Aspect| Info ---|--- API Stability| Development Zig Version| 0.16.0 Platforms| Linux, macOS, Windows License| MIT Features PIV Support NIST SP 800-73-4 Certificate retrieval slots...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – ECDSA Nonce Reuse in IoT Firmware Signing Program Code Python root@kitploit: ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images with sam...

SecureML

SecureAIML 🔐 Seguridad de Modelos de IA de Nivel Empresarial construida sobre OpenSSF Model Signing SecureAIML es el "Stripe de la seguridad de modelos": hace que la protección de modelos de IA de grado empresarial sea accesible, fácil de usar y lista para producción para todas las organizaciones...

CVE-2019-16098

CVE-2019-16098 El controlador en Micro-Star MSI Afterburner 4.6.2.15658 también conocido como RTCore64.sys y RTCore32.sys permite que cualquier usuario autenticado lea y escriba en memoria arbitraria, puertos de E/S y MSRs. Esto puede ser explotado para escalada de privilegios, ejecución de códig...

PT-2026-90520

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

HTTPSignatures

HTTPSignatures Burp Suite Extension HTTPSignatures is a Burp Suite extension that implements the Signing HTTP Messages draft-ietf-httpbis-message-signatures-01 specification draft document. This allows Burp Suite users to seamlessly test applications that require HTTP Signatures. Features...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

certReport

CertReport This tool is intended to reduce the load of effort required to report authenticode certificates. It is intended to take the smallest amount of effort from the reporter, but provide the certificate authority with most the information they need to make a decision. When possible, it is...

kit-jwt

kit-jwt JSON Web Token JWT encoding and decoding for Kit TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit LICENSE| MIT license file README.md| This file...

cve-2026-49352-poc

CVE-2026-49352 — Обход аутентификации через жестко заданный секрет JWT в 9router Содержание Обзор Затронутые версии Причина Анализ Структура репозитория Требования Использование Ожидаемый вывод Ссылки Отказ от ответственности Обзор CVE-2026-49352 — это уязвимость в 9router, самостоятельном прокси...

CVE-2026-86819

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...

EUVD-2026-74192

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...