ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

stegcloak

StegCloak La Capa de Invisibilidad para tus textos StegCloak es un módulo de esteganografía puro en JavaScript diseñado con un estilo de programación funcional, para ocultar secretos dentro de texto comprimiendo y cifrando el secreto antes de camuflarlo con caracteres Unicode invisibles especiale...

PoC-CVE-2020-9715

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only. Vulnerability Adobe Acrobat Reader DC = 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding ANSI or...

reverse-captcha-eval

Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection An evaluation framework that tests whether large language models follow invisible Unicode-encoded instructions embedded in otherwise normal-looking text. Where traditional CAPTCHAs exploit tasks humans can...

confusable-vision

confusable-vision Empirical glyph similarity scoring using vector-outline raycasting. Renders Unicode confusable character pairs across 245 system fonts, measures structural similarity from font outlines directly no rasterization, and produces scored JSON artifacts with per-font continuous distan...

CVE-2021-42574

CVE-2021-42574 - Code generator // Update: 05.11.2021 It's now possible to not only encode, but also decode files. Means that now files containing supported bidi chars can be translated to template files with bidi placeholders LRO, .... Generate malicious files using recently published bidi-attac...

exfil-scan

exfil-scan Scan LLM outputs and AI-generated content for data exfiltration signals before they reach users, logs, or downstream systems. 1 Why exfil-scan exists Modern LLM applications routinely process sensitive prompts, internal documents, API responses, and user data. That creates a new securi...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

glassworm-hunter

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

CVE-2021-32708

CVE-2021-32708 Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. How the Exploit Works...

CVE-2025-12758

CVE-2025-12758: Validator.js isLength Unicode Variation Selector Bypass CVE ID: CVE-2025-12758 CVSS Score: 8.7 HIGH Severity: HIGH CWE: CWE-792 Incomplete Filtering of One or More Instances of Special Elements Published: November 26, 2025 Disclosed: October 19, 2025 Vulnerability Overview This...

CVE-2021-45067

CVE-2021-45067 This bug was Out of Bounds Read caused by treating ANSI string as Unicode which can be exploited to leak sensitive information from the sandboxed adobe reader process. Blog Adobe Reader - XFA - ANSI - Unicode Confusion Information Leak Advisory CVE-2021-45067 Demo...

CVE-2025-64458-Demo

CVE-2025-64458 — Django Redirect DoS on Windows Description A denial-of-service DoS issue in Django’s redirect responses allows an attacker to trigger excessive CPU work during URL normalization when constructing redirect responses. On Windows, Python’s Unicode NFKC normalization is particularly...

golang-x-text

Go Text This repository holds supplementary Go packages for text processing, many involving Unicode. CLDR Versioning It is important that the Unicode version used in x/text matches the one used by your Go compiler. The x/text repository supports multiple versions of Unicode and will match the...

Burp-Encode-IP

About This extension will encode an IP address into a bunch of less known encoding techniques. This technique is focused on testing vulnerabilities such as SSRF Server-Side Request Forgery, Open Redirect or RFI Remote File Inclusion. TL;DR Easy Install If you have Burp Pro it is possible to insta...

uriDeep

uriDeep Unicode encoding attacks with machine learning. Tool based on machine learning to create amazing fake domains using confusables. Some domains can deceive IDN policies Chrome & Firefox. I created the best big dictionary of confusables using neural networks. It is used in the tool and it ca...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

e-cology

Weaver e-cology OA Beanshell Component Remote Code Execution Windows Linux Notes Detect the target system's os.name if the target system is Windows, executing commands such as set requires manually typing cmd.exe /c set Use Unicode to bypass the exec filter on some sites. Payload root@kitploit:...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 According to The National Vulnerability Database NVD CVE-2021-41773, Apache HTTP Server 2.4.49 is vulnerable to Path Traversal and Remote Code execution attacks. Path Traversal The path traversal vulnerability was introduced due to the new code change added for path...

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...