cve-2020-16012

This repo contains PoCs for CVE-2020-16012, a side channel vulnerability in the implementation of CanvasRenderingContext2D.drawImage in Firefox and Chromium. Read a writeup of this vulnerability on the Mozilla Attack & Defense blog. Inside benchmark is code for measuring the timing of the...

slipstream

NAT Slipstreaming NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to any system behind a victim's NAT, bypassing the victim's NAT/firewall remote arbitrary firewall pinhole control, just by the victim visiting a website. v1 developed by : @SamyKamkar //...

sniffly

Sniffly2 Sniffly2 is a variant of Sniffly which abuses HTTP Strict Transport Security headers and the Performance Timing API in order to sniff your browsing history in Chromium-based browsers. Demo Visit http://diracdeltas.github.io/sniffly in Chrome/Chromium/Brave/etc. with HTTPS Everywhere...

wp_drupal_timing_attack

wpdrupaltimingattack Scripts de Python para explotar CVE-2014-9016 y CVE-2014-9034. Solo con fines legales...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

mt6985-CVE-2026-43499

CVE-2026-43499 失败记录：MT6985 适配尝试 结论 : 花了 68M tokens，没拿到 root。 原因 : KernelSnitch 时序攻击在 MTK Dimensity 9200 上不可靠，CONFIGPANICONOOPS=y 不给试错空间。 这篇文章记录了完整踩坑过程，供后人参考避坑。 背景...

ch55x_firmware_extractor

CH55x 固件提取器 CH55x 固件提取器用于从 CH55x 集成电路中读取固件。这些器件本身并不支持通过引导加载程序直接读取固件。然而，它提供了一种功能，可以一次 8 字节地将固件内容与提供的数据进行验证。该功能容易受到教科书式的时间攻击，这正是本文所利用的方法，从而允许从这些设备中提取固件。引导加载程序可以通过 USB 或 UART 访问。此固件提取器仅适用于 UART，因为 USB 的较高延迟会使这种攻击变得困难。已测试的芯片为 CH552 和 CH554，引导加载程序版本为 2.4 和 2.5。固件提取器的硬件方案基于 STM32 Blue...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2016-6210-Exploit

这是针对 CVE-2016-6210 的“武器化”漏洞利用的第一个版本 背景： 由 Eddie Harari 在 Full Disclosure 上发布 http://seclists.org/fulldisclosure/2016/Jul/51 简要说明： 通过发送大密码，远程用户可以枚举运行SSHD的系统上的用户。由于计算SHA256/SHA512哈希比BLOWFISH哈希花费的时间长得多，大多数现代配置中都存在此问题。 更技术性的说明： 当SSHD尝试认证一个不存在的用户时，它会使用SSHD源代码中硬编码的虚假密码结构。这个硬编码密码结构中的密码哈希基于BLOWFISH...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

EUVD-2026-68098

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...

CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC Questo script Python è una proof-of-concept PoC per eseguire attacchi SSRF Server-Side Request Forgery e Timing Attack contro SAP BusinessObjects Launchpad. È progettato per aiutare ricercatori e professionisti della sicurezza a identificare ...

ALPINE-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...

EUVD-2026-67676

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

lucky13

LUCKY13 Exploit Dieses Repository enthält einen Proof-of-Concept POC Exploit für die LUCKY13-Sicherheitslücke CVE-2013-0169, einen Timing-Angriff gegen bestimmte Implementierungen des CBC-Modus Cipher Block Chaining in kryptografischen Systemen. Der Exploit zielt darauf ab, ein Ziel-Token zu...

CVE-2016-6210

CVE-2016-6210 Benutzernamen-Enumeration gegen SSH-Daemons, die von CVE-2016-6210 betroffen sind. Nur gegen eigene Hosts verwenden! Das Angreifen von Systemen, für die du keine Berechtigung hast, kann dich in große Schwierigkeiten bringen! INSTALLATION Repository klonen: root@kitploit: git clone...