r2gopclntabParser

r2gopclntabParser 참고: 이 기능은 gopc 분석 플러그인으로 radare2 코어에 직접 구현되었습니다. 완전히 스트립된stripped 바이너리를 포함한 Go 바이너리에서 함수 심볼을 복구하기 위한 radare2 기반 Go gopclntab 파서입니다. Go 버전 1.2, 1.16, 1.18, 1.20+의 ELF, Mach‑O, PE 바이너리를 지원합니다. 모든 Go 1.2+ 바이너리에는 gopclntabProgram Counter Line Table이라는 데이터 영역이 내장되어 있으며, Go 런타임이 스택...

resym

ReSym アーティファクト このリポジトリは、論文 "ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries" CCS 2024 のアーティファクトを提供します。 🏆 ACM SIGSAC Distinguished Paper Award 受賞 注意 : 当アーティファクトは積極的にメンテナンス・更新されています。最新バージョンを使用していることを確認してください。 提供されるデータとリソース データ準備スクリプト : processdata...

kong

Kong: 에이전틱 리버스 엔지니어 바이너리 리버스 엔지니어링을 위한 LLM 오케스트레이션 Kong이란 무엇인가? 대부분의 작업은 선형 관계를 따릅니다. 작업이 어려울수록 시간이 더 오래 걸리는 경향이 있습니다. 하지만 리버스 엔지니어링및 바이너리 분석은 실제 난이도는 다소 사소하지만 실행 시간이 몇 시간또는 며칠!이 걸릴 수 있는 작업입니다. 심지어 함수가 수백 개도 안 되는 바이너리라도 말이죠. Kong은 NSA 등급의 리버스 엔지니어링 프레임워크를 사용하여 기계적 계층을 자동화합니다. Kong은 완전히 난독화되고 스트립된...

fnprint

fnprint matches functions in binaries by what they do , not by what their bytes or control-flow graphs look like. it runs each function in a tiny emulator with made-up inputs, records the side effects it produces, and hashes that behavior into a fingerprint. two functions that behave the same get...

KernelPatch

KernelPatch ストリップされた Linux カーネルイメージのみで Linux カーネルにパッチを適用し、フックする。 root@kitploit: | |/ / | | \ | | | | | ' // \ '| ' \ / \ | | / | / | ' \ | . \ / | | | | | / | / | | || | | | | ||\|| || ||||| ,|\|| || ソースコードやシンボル情報なしで、すべてのシンボル情報を取得する。 カーネルに任意のコードを注入する。（カーネルイメージへの静的パッチ、または実行時の動的ロード）。...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: hsr: avoided possible NULL dereference in skbclone The syzbot encountered a crash 1 in skbclone, caused by a bug in hsrgetuntaggedframe. When/if createstrippedskbhsr returns NULL, we must not attempt to call skbclone...

BIT-MODSECURITY-2026-52747 ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and...

CVE-2026-50184

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during...

CVE-2026-44503 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

The RedirectHandler middleware in microsoft/kiota-java com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0 and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie,...

CVE-2026-4057

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic and makeMediaPrivate functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for editposts capability...

GHSA-X8JC-JVQM-PM3F File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

Summary The signupHandler in File Browser applies default user permissions via d.settings.Defaults.Applyuser, then strips only Admin commit a63573b. The Execute permission and Commands list from the default user template are not stripped. When an administrator has enabled signup, server-side...

SQL Injection

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to SQL Injection in the getAllCategories function via the doNotShowCats parameter due to insufficient sanitization, where only single quotes are stripped but...

Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent

Understanding TTPs Tactics, Techniques, and Procedures in malware binaries is essential for security analysis and threat intelligence, yet remains challenging in practice. Real-world malware binaries are typically stripped of symbols, contain large numbers of functions, and distribute malicious...

CVE-2022-50817

In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid possible NULL deref in skbclone syzbot got a crash 1 in skbclone, caused by a bug in hsrgetuntaggedframe. When/if createstrippedskbhsr returns NULL, we must not attempt to call skbclone. While we are at it, replac...

CVE-2022-50817

In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid possible NULL deref in skbclone syzbot got a crash 1 in skbclone, caused by a bug in hsrgetuntaggedframe. When/if createstrippedskbhsr returns NULL, we must not attempt to call skbclone. While we are at it, replac...

CVE-2022-50817 net: hsr: avoid possible NULL deref in skb_clone()

In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid possible NULL deref in skbclone syzbot got a crash 1 in skbclone, caused by a bug in hsrgetuntaggedframe. When/if createstrippedskbhsr returns NULL, we must not attempt to call skbclone. While we are at it, replac...

CVE-2022-50817

CVE-2022-50817 : Linux kernel vulnerability in the HSR path where a NULL pointer deference could occur in skb_clone(), triggered by a bug in hsr_get_untagged_frame(). The issue arises when create_stripped_skb_hsr() returns NULL and skb_clone() is still invoked. Documents consistently describe the...

Malicious code in @akunsansan0/biru38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbf8db8917918d0a3bcef7943fefa20905495de9100964af08f1ceef9a0e1268 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masoodkashif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ded60cfbd213b919dc7d7f1a49b2e4580ba95ab161cb3a7444aa060de5d9f529 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hariyono-poke112 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25303934a10b7a6302c8adf799c7244df48ae152b1bfe8499cb5ca783fe587b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...