rdesktop

IMPORTANT: rdesktop is no longer maintained Please, beware that this project is no longer maintained and hadn't received a patch in many years. There are reported security vulnerabilities, yet those haven't been reviewed. Use with caution and use it at your own risk. rdesktop - A Remote Desktop...

howdy

Howdy provides Windows Hello™ style authentication for Linux. Use your built-in IR emitters and camera in combination with facial recognition to prove who you are. Using the central authentication system PAM, this works everywhere you would otherwise need your password: Login, lock screen, sudo,...

nextcloud-ldap-put-isadmin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin Write-up: https://abraxaslabs.tech/research/nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin...

reko

reko - a general purpose decompiler. Reko Swedish: "decent, obliging" is a decompiler for machine code binaries. This project is freely available under the GNU General Public License. The project consists of front ends, core decompiler engine, and back ends to help it achieve its goals. A...

Persistence-Survivability

Persistence Survivability Rating This project uses the Duqu style persistence as a TTP and was presented at Bsides Augusta – RAT. This project is PowerShell based and can be used with credentials and without. For more info please read the .ps1 file. Basic use: Invoke-FindPersitence...

c2-printf

C2-PRINTF is a small utility that lets you do printf-style debugging over a C2 debugger connection, for use with the Silicon Labs EFM8 and C8051F microcontrollers. Full write up available on my blog: https://jaycarlson.net/2017/07/16/printf-style-trace-messages-using-c2/ If you build the WPF...

ZoneClaw-code

ZoneClaw Experiment code for ZoneClaw: Mitigating Persistent Memory Attack by Establishing Memory-Zoning among OpenClaw-Style Computer-Use Agents. This repository contains the benchmark tasks, defense implementations, and evaluation scripts used in the paper. The benchmark studies cross-session...

CVE-2023-4357-APT-Style-exploitation

CVE-2023-4357-APT-Style-exploitation Apt style exploitation of Chrome 0day CVE-2023-4357 https://ogulcan-unveren.medium.com/seviye-y%C3%BCkseltmek-chrome-zerodayi-xss-ile-tetiklemek-23b8498f9701...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

GlacierCTF2023_writeups

Glacierctf 2023 Description CTF date: 24.11.2023 - 26.11.2023 Duration: 48 hours CTF Time: https://ctftime.org/event/1992 GlacierCTF 2023 was the second edition of the jeopardy-style CTF organized by LosFuzzys. The CTF featured challenges in various categories, including pwn, rev, web, crypto,...

CVE-2026-21011-Log4j-style-JNDI-Injection-in-Custom-Logger-Simulated-

CVE-2026-21011 – Log4j‑style JNDI Injection in Custom Logger Simulated Program Code Java simulation in Python log4jsim.py - Custom logger that evaluates $... patterns import subprocess, re def logmessage: Vulnerable: looks up JNDI-like syntax and executes pattern = r'$\jndi:.+?' for match in...

CVE-2026-126207

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrubcss checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses,...

GHSA-M3X9-938Q-5767 Loofah: CSS url() sanitization bypass via escaped parentheses

Summary Loofah::HTML5::Scrub.scrubcss rejected any property whose top-level Crass tokens included a :url or :badurl, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrubcss rebuilt each property it emitted identifiers with...

CVE-2026-126207

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrubcss checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses,...

CVE-2026-74239

CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...

spoofed

Spoof Toolkit v2.1 Professional-grade async Python network spoofing suite Interactive menu-driven UI · Full IPv4/IPv6 coverage · Responder-style poisoning Authorized security testing only — by amibhai Disclaimer: This tool is for educational purposes and authorized security auditing only. The...

weakrng-sweep

weak-rng sweep CVE-2026-71851 class Research tool: enumerates PRNG schemes x uint32 seeds, derives BIP39 wallets, checks membership against a victim address set defensive research, illbloom-style. Schemes: 0-10 illbloom: MT19937/glibc/Java/LCG/xorshift, 11-13 glibc-31 LCG, 14-15 crypto-js 3.3.0...

metasploit-framework-nu11secur1ty

Metasploit Framework The Metasploit Framework is an open-source tool released under a BSD-style license. For detailed licensing information, refer to the COPYING file. Latest Version Access the latest version of Metasploit from the Nightly Installers page. Documentation Comprehensive documentatio...

CVE-2026-68540

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. Thi...

CVE-2026-68540

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. Thi...