CVE-2020-0601-spoofkey

CVE-2020-0601-spoofkey Para ver cómo crear una clave falsificada y firmar el código Requisitos: openssl, main.rb que subí VISITA: https://twitter.com/exploitblizzard...

Apache CloudStack - SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

dnspooq

dnspooq DNSpooq PoC - envenenamiento de caché de dnsmasq CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 Solo con fines educativos Requisitos Docker compose Docker Exploit Iniciar contenedores $ docker-compose up -d Ejecutar exploit.py $ docker-compose exec attacker bash bash-5.0 python exploit.py...

wifi-deauth

一种拒绝服务攻击，可断开目标WiFi网络中的所有设备。 不需要网络密码 已在Kali NetHunter上测试（底部有截图） 重要提示 在某些情况下，网络AP可能会在同一个BSSID/SSID名称下同时运行5GHz和2.4GHz频段。 为了真正使AP瘫痪，我通常同时运行两个去认证工具，使用两个网络接口：一个用于2.4GHz，一个用于5GHz。 频段| 信道范围 ---|--- 2.4 GHz| 1 14 5 GHz| 35 165 工作原理 程序遍历所有可能的信道，通过嗅探802.11包来确定哪些接入点可用。 攻击者选择要攻击的目标接入点后，程序会： 1...

CVE-2024-30850-chaos-rat-rce-poc

https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc/assets/146861503/ac03c8c7-54b3-4280-9f29-719c44af5192 CHAOS RAT v5.01 panel web RCE CVE-2024-30850, CVE-2024-31839 https://github.com/tiagorlampert/CHAOS Este exploit funciona suplantando una devolución de llamada de agente para un XSS...

CarbonCopy

CarbonCopy 一种工具，可创建任何在线网站的伪造证书，并为可执行文件签名以绕过AV检测。适用于Windows和Linux。 先决条件 要在Linux上使用，请执行以下命令： apt-get install osslsigncode pip3 install pyopenssl...

EvilSlackbot

EvilSlackbot 一个用于在 Slack 工作区中进行红队和钓鱼演练的 Slack 攻击框架。 免责声明 本工具仅供安全专业人员使用。未经明确测试许可，请勿针对任何 Slack 工作区使用此工具。使用风险自负。 背景 成千上万的组织使用 Slack 来帮助员工沟通、协作和互动。许多 Slack 工作区会安装可用于自动执行不同任务的应用程序或机器人。这些机器人被单独授予权限，规定它们被允许通过 Slack API 请求执行哪些任务。为了向 Slack API 进行身份验证，每个机器人都会被分配一个以 xoxb 或 xoxp 开头的 API...

phishurl-list

Conjunto de datos de URL de phishing de JPCERT/CC Detalles de las columnas date: Fecha confirmada por JPCERT/CC URL: URL completa de un sitio de phishing description: Información sobre una marca suplantada Página de estadísticas https://jpcertcc.github.io/phishurl-list/...

CVE-2026-103397 OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged...

CVE-2026-103397

The OpenSave software prior to version 2.4.0-beta.1 is vulnerable to an authentication bypass due to insufficient validation of sender identities in WAN relay requests. An attacker who knows the room code can join a room, extract paired peer identifiers from announcements, and then spoof the Rela...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

Linux Distros Unpatched Vulnerability : CVE-2026-102601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by...

CVE-2026-102305

Google Chrome on iOS versions prior to 154.0.8037.92 is vulnerable to a UI misrepresentation issue within the SignIn functionality. A remote attacker can exploit this by using a crafted HTML page to spoof UI elements . The Chromium security severity for this vulnerability is rated as Low . No spe...

DEBIAN-CVE-2026-95307

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95309

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95307

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95294

Google Chrome versions prior to 154.0.8037.57 are vulnerable to a UI misrepresentation flaw in the Browser component. A remote attacker can exploit this by leveraging social engineering to spoof UI elements through a crafted HTML page. Remediation is available in version 154.0.8037.57 ; for examp...

CVE-2026-95294

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...