Discover RUB-NDS/SAML-XXE-Test Open Source project

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".

3,909

Terrapin-Scanner

887

WS-Attacker

WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum (https://nds.rub.de/ ) and the Hackmanit GmbH (https://www.hackmanit.de/).

A simple CORS misconfiguration scanner

469

CORStest

A tool to generate media files with malicious metadata

387

Metadata-Attacker

PHP

124

BurpSSOExtension

An extension for BurpSuite that highlights SSO messages in Burp's proxy window..

Artifacts for the Black Hat talk.

116

PDF101

REST-Attacker is designed as a proof-of-concept for the feasibility of testing generic real-world REST implementations. Its goal is to provide a framework for REST security research.

REST-Attacker

XS-Leak Browser Test Suite

xsinator.com

Artifacts to the ALPACA attack.

alpaca-code

DTD-Attacks

Tests for different parsers from Ruby, Python, .NET, PHP, Perl, Java

Artifacts for the USENIX publication.

Johnny-You-Are-Fired

MS-RMS-Attacks

Breaking the security of Microsoft's RMS

This repository contains the artifacts for the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".

Terrapin-Artifacts

JOSEPH

OpenID-Attacker

PrOfESSOS is our open source implementation for fully automated Evaluation-as-a-Service for SSO. PrOfESSOS introduces a generic approach to improve the security of OpenID Connect implementations by systematically detecting vulnerabilities.

PrOfESSOS

pdf-attacker

Latex template for students writing a bachelor or master thesis

thesis_layout

TeX

ikev1-psk-main-mode-dict-attacker

Proof-of-Concept Dictionary Attacker against IKEv1 PSK in Main Mode

Simple proxy designed to intercept and modify connections on the transport level. This means you can also modify TLS raw bytes.

SocketProxy

Artifacts for the WOOT publication.

Office-Security

FutureTrust analyzes electronic identification (eID) services in Europe and beyond. It is funded within the EU Framework Programme for Research and Innovation (Horizon 2020).

FutureTrust

Dynamic In-Browser Single Sign-On Tracer Inspecting Novel Communication Techniques

DISTINCT

Find XS-Leaks in the browser by diffing DOM-Graphs in two states

OOXML_Signature_Security

USENIX 2023 Artifacts

AutoLeak

SOAP webservices of different SOAP frameworks including samples for WS-Security.

your-sop.com

PHP

SOAP-Test-Webservices

Artifacts for the DEF CON talk.

Covert-Content-Attacks

exposee_layout

Latex template for students writing an exposé for a seminar or thesis

TeX

WS-TLS-Scanner

The TLS-Scanner for the SIWECOS Project

CVE-2020-2655-DemoServer

A Secure, Efﬁcient, and Collaborative Real-Time Web Editor

SECRET

CoffeeScript

Gridcoin-Attacks

The source code of our attacking tool described in the paper "Breaking and Fixing Gridcoin" published at WOOT'17, see also:

Examples for using Java Crypto

JavaCryptoExamples

This repository hosts the public website for the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation" via GitHub Pages.

Terrapin-Website

Implementation of ratcheted key exchange protocol (Poettering and Rösler, CRYPTO 2018, https://ia.cr/2018/296) by Marco Smeets

RKE

Denial_of_Service - A git submodule for WS-Attacker

WS-Attacker-Plugin_Denial_of_Service

A Key Management Server for SyncEnc

SyncEnc-Keyserver

Intelligent_Denial_of_Service_Library - A git submodule for WS-Attacker

WS-Attacker-Library_Intelligent_Denial_of_Service_Library

PDF Tester can be used to evaluate the signature status of a PDF document under different PDF applications.

PDF-Tester

JsseTLS

BouncyCastle TLS examples

BouncyCastleTLS

Signature_Faking_Library - A git submodule for WS-Attacker

WS-Attacker-Library_Signature_Faking_Library

alpaca-attack

AKE-Cryptoverif-Tutorial

Research Artifacts for the Publication "Mitigation of Attacks on Email End-to-End Encryption"

Mitigation-of-Attacks-on-Email-E2E-Encryption

Extract the state machine of an IKEv1/IKEv2 implementation

IPsec-StateMachineExtractor

SyncEnc-App

XML_Encryption_Attack_Library - A git submodule for WS-Attacker

WS-Attacker-Library_XML_Encryption_Attack_Library

Single-Sign-On-Libraries

Library to allow concurrent editing of XML documents using Operational Transforms based on ShareJS 0.6

ShareJSXML

CoffeeScript

SyncEnc-Demonstrator

A Demonstrator for Collaborative Encrypted Editing

SoapAction_Spoofing - A git submodule for WS-Attacker

WS-Attacker-Plugin_SoapAction_Spoofing

Signature_Wrapping - A git submodule for WS-Attacker

WS-Attacker-Plugin_Signature_Wrapping

XML_Encryption_Attack - A git submodule for WS-Attacker

WS-Attacker-Plugin_XML_Encryption_Attack

Intelligent_Denial_of_Service - A git submodule for WS-Attacker

WS-Attacker-Plugin_Intelligent_Denial_of_Service

An implementation for the XML Security Standard using the W3C WebCrypto API

XMLSec-WebCrypto

CoffeeScript

oidc-docker-libs

Fuzzing plattform for medical protocols

medfuzz

Automation tool for evaluating the signature status of office documents

DocumentSignatureValidator

SoapHttpClient - A git submodule for WS-Attacker

WS-Attacker-Library_SoapHttpClient

Signature_Wrapping_Library - A git submodule for WS-Attacker

WS-Attacker-Library_Signature_Wrapping

WS_Addressing_Spoofing - A git submodule for WS-Attacker

WS-Attacker-Plugin_WS_Addressing_Spoofing

WS-Attacker-Library_XML-Utilities- A git submodule for WS-Attacker

WS-Attacker-Library_XML_Utilities

OptionsTesterPlugin - A git submodule for WS-Attacker

WS-Attacker-Plugin_OptionsTesterPlugin

Schema_Analyzer_Library - A git submodule for WS-Attacker

WS-Attacker-Library_Schema_Analyzer