kbd-audio

kbd-audio This is a collection of command-line and GUI tools for capturing and analyzing audio data. Keytap The most interesting tool is called keytap - it can guess pressed keyboard keys only by analyzing the audio captured from the computer's microphone. Check this blog post for more details:...

PGP-Tools

PGP Tools Open-source browser extension for PGP encryption, decryption, and signing. Built with Rust/WebAssembly. Private keys never touch the JS heap unless they have to. Get it here Why PGP Tools? Open source and transparent. Most PGP browser extensions are closed source. You shouldn't trust a...

grdpwasm

grdpwasm A web-based RDP client built with Go WebAssembly and grdp. Connect to a Windows Remote Desktop server directly from your browser — no plugins required. Architecture Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server Because browsers cannot open raw TCP sockets, a lightweight Go pro...

octopus

Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...

capsule

Capsule Getting Started • Documentation • Issues • Contributing Overview Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : S...

wasmforge

WasmForge WasmForge compiles Go and C programs to WebAssembly, then packages them as single native binaries. The resulting executables sandbox guest code inside a WASM runtime a per-build fork of wazero. From inside that sandbox, guests get transparent access to networking, raw sockets, Win32 API...

rzweb

RzWeb RzWeb is a browser-based reverse engineering interface powered by Rizin compiled to WebAssembly. Drop a binary into the app and analyze it locally in your browser with a persistent session, terminal access, cached re-open support, and dedicated views for disassembly, decompilation,...

webvm

WebVM This repository hosts the source code for https://webvm.io, a Linux virtual machine that runs in your browser. Try out the new Alpine / Xorg / i3 graphical environment: https://webvm.io/alpine.html What is WebVM? WebVM is a server-less virtual environment running fully client-side in...

r2web

r2web: Access radare2 from anywhere, anytime. Overview r2web lets you run radare2 without local installs or platform hassles. Analyze files directly in your browser. It runs entirely client-side using radare2 WASI and Wasmer, with an xterm.js frontend for interactive command execution. 👉 Try it...

vpod

Vpod Live demo • Getting Started • Documentation • Issues • Contributing What is a vpod ? A vpod is a lightweight, portable sandbox that gives an untrusted process an instant Linux environment. It uses a RISC‑V architecture and runs entirely inside WebAssembly. Fast startup : Boot in under a...

trajan

Trajan: CI/CD セキュリティスキャナー Trajan は、攻撃者がソフトウェアサプライチェーンを侵害するために使用するセキュリティ脆弱性を CI/CD パイプラインでスキャンします。GitHub Actions、GitLab CI、Azure DevOps、Jenkins、JFrog をサポートしています。 機能 Trajan は、ワークフロー YAML ファイルを解析し、依存関係グラフを構築し、検出プラグインを実行し、組み込みの攻撃機能による悪用可能性を検証します。 32 の検出プラグイン（複数の CI/CD プラットフォーム対応） 24 の攻撃プラグイン（複数の CI/C...

evtx

EVTX Windows XML 이벤트 로그 형식을 위한 크로스 플랫폼 파서 기능 🔒 100% 안전한 Rust로 구현 — Rust가 지원하는 모든 플랫폼stdlib 포함에서 작동합니다. ⚡ 빠름 — 아래 벤치마크를 참조하세요. 다른 구현체보다 몇 배 더 빠릅니다! 🚀 멀티스레드 지원. ✨ XML 및 JSON 출력 지원. 둘 다 공유 중간 표현IR에서 직접 구성됩니다xml2json 변환 없음!. ⛏️ 누락된 레코드/청크의 기본적인 복구를 지원합니다! 🐍 Python 바인딩도 제공:...

CVE-2018-17463

CVE-2018-17463 Working Proof of Concept Exploit for CVE-2018-17463 utilzing WebAssembly RWX Pages for Shellcode execution. CVE-2018-17463 stemmed from the incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64, allowing a remote attacker to execute arbitrary code inside a...

toy-wasm-symbexp

toy-wasm-symbexp 이것은 장난감 WASM 심볼릭 인터프리터입니다. 다음 글들을 설명합니다: Part 1 - 소개 Part 2 - 구체적 인터프리터 작성 - 이 단계의 코드 보기 Part 3 - 심볼릭 인터프리터 작성 - 이 단계의 코드 보기 Part 4 - 심볼릭 인터프리터 작성 및 챌린지 풀기! - 이 단계의 코드 보기 사용법 편리한 Makefile이 프로그램이 제대로 동작하는지 테스트할 수 있게 도와줍니다: $ make test $ make part1-custom $ make part1-smt $ make...

skyhook

Skyhook Skyhook는 IDS 구현으로 방어된 네트워크에서 파일을 들여오고 내보내는 데 사용되는 REST 기반 유틸리티입니다. React, 바닐라 JS 및 웹 어셈블리를 혼합하여 파일 전송을 관리하는 사전 패키지된 웹 클라이언트가 함께 제공됩니다. 주요 링크 여기에서 다운로드 시작하려면 사용자 문서를 참조하세요 기능 왕복 파일 콘텐츠 난독화 사용자 구성 가능한 난독화 체이닝 자체 서명 및 Lets Encrypt 인증서 획득 방법 구성 및 파일 전송을 위한 내장 웹 애플리케이션. 서버 지문 인식 탄력 기술: 파일 전송...

webvm

WebVM This repository hosts the source code for https://webvm.io, a Linux virtual machine that runs in your browser. Try out the new Alpine / Xorg / i3 graphical environment: https://webvm.io/alpine.html WebVM is a server-less virtual environment running fully client-side in HTML5/WebAssembly. It...

EUVD-2026-81605

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly サンドボックスエスケープ CVE-2026-2796 の概念実証エクスプロイトチェーン。Mozilla SpiderMonkey の WebAssembly インポート最適化（"JavaScript: WebAssembly" コンポーネント）における JIT 誤コンパイル / 型混乱です。細工された wasm モジュールにより、ホストプロセス全体に対する任意読み書き と任意のネイティブコード実行 が可能となり、WebAssembly サンドボックスから脱出します。 CVE: CVE-2026-2796...

CVE-2021-38297-Go-wasm-Replication

🚨 Exploiting CVE-2021-38297: A Journey into GO Wasm Buffer Overflow 🚨 🌐 Overview of the Vulnerability 🌐 WebAssembly WASM 🌍, a cutting-edge binary instruction format, enables the seamless execution of high-level languages like C, C++, Rust, and GO in modern web browsers. However, the discovery of...

CVE-2026-15718-who-put-ptrs-in-my-wasm

CVE-2026-15718 — 誰が俺のwasmにptrsを入れたんだ CVE-2026-15718 の概念実証（PoC）エクスプロイトチェーン。これは Mozilla SpiderMonkey の WebAssembly baseline コンパイラ（「JavaScript: WebAssembly」コンポーネント）における sync 欠落による誤コンパイルです。単一のゼロ回実行 array.fill が fakeobj プリミティブを生み出し、チェーンはホストプロセスの任意読み取り/書き込み と任意のネイティブコード実行 （posixspawnp"/bin/sh",...