hannob/php-crashers

Stars
448
Rank 97,523 (Top 2 %)
Language
PHP
License
The Unlicense
Created almost 8 years ago
Updated 10 months ago

hannob/php-crashers

hannob

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Example scripts that cause segfaults in PHP

php-crashers

Example scripts that cause segfaults in PHP

description

PHP is a memory safe language with a garbage collector, thus it usually shouldn't crash unless there is a bug.

However while analyzing why PHP services crash I occasionally found situations where PHP crashed that the PHP developers didn't consider worth fixing. I'll collect them here.

links

snallygaster

Tool to scan for secret files on HTTP servers

bashcheck

test script for shellshocker and related vulnerabilities

vulns

Named vulnerabilities and their practical impact

meltdownspectre-patches

Summary of the patch status for Meltdown / Spectre

vacdec

Python script to decode the EU Covid-19 vaccine certificate

optionsbleed

tlshelpers

A collection of shell scripts that help handling X.509 certificate and TLS issues

tls-what-can-go-wrong

TLS - what can go wrong?

smtpsmug

hpkp

HTTP Public Key Pinning (HPKP) pin generation tools

apache-uaf

Apache use after free bug infos / ASAN stack traces

superfishy

Archive of software and other data involved in the Superfish / Komodia incident

fpmvuln

bash poc scripts to exploit open fpm ports

lecaa

Check for Let's Encrypt CAA issue

hackercon

List of Free Software and IT Security related conferences

bignum-fuzz

Code to fuzz bignum libraries

selftls

Sample application to let OpenSSL talk to itself (for fuzzing)

pgpecosystem

Scripts to parse and analyze pgp key server data

com2txt

com2txt tool (from 1993)

zipeinfo

ZIP encryption info

alphasecret

Find PNG files with suspicious data in alpha channel

ctgrab

pgpbugs

A history of PGP-related vulnerabilities

mmapfail

Simple shell script to detect bad checks of mmap() return value

ed25519hetzner

Script to scan OpenSSH host key and known_hosts files for shared keys from server hoster Hetzner

pwncloud

proof of concept to backdoor files from owncloud encryption module

svnscraper

bash script to download publicly available .svn directories

libfuzzer-examples

examples for libfuzzer

secpw

Secure random passwords in Javascript

ipmx

badocspcert

Check for certs affected by July 2020 OCSP intermediate incident

jitsivuln

Check for jitis meet default password vulnerability

primecheck

Check Diffie Hellman group prime parameter

pypi-bad

Bad packages from the pypi repository

httpstime

Setting the system time over HTTPS

mbox2maildir

Script to convert between mbox and maildir format

webminex

poc exploit for webmin backdoor (CVE-2019-15107 and CVE-2019-15231)

asantoo

Overlay to use Gentoo with Address Sanitizer

emailprotocols

An overview of E-Mail protocols and data formats

silic

silic - simple link checker written in python

rpter

Parse mails with reports from DMARC and SMTP TLS Reporting

uudeview

Decoder and encoder for Base64 (MIME), uuencoded, xxencoded and Binhex files.

rompager-check

Online and offline check tool for the RomPager HTTP server and vulnerable versions

tmobile-login

Trivial bash script to log into Telekom / T-Mobile wireless lan

fritzbox-keys

private keys found on AVM Fritz!Box firmware images

pwsec

Simple password generator with no options

xssgame

exif2osm

Convert JPEG exif geotags to link on openstreetmap.org

pwbloom

Simple web index to use bloom filter for Pwned Passwords

htpasswdos

Proof of concept for Apache htpasswd denial of service

symlinkown

Patch for the Linux Kernel to implement "SymlinksIfOwnerMatches" features

rdrand-test

Testing the rdrand CPU instruction

crimesafe-csrf

Create CSRF tokens secure from compression attacks like CRIME/BREACH/TIME/HEIST

cbugs

examples for C / C++ bugs caught by various safety tools

procdown

Harden access to the /proc filesystem in Linux

CVE-2020-27603-bbb-libreoffice-poc

Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button

svgx

Shell script chaining various SVG optimization tools

smtpsend

Command line tool to send mails with authentication

fcrdns

Command line Forward-confirmed reverse DNS (FCrDNS) check written in Python

rosproject-scripts

Scripts to compile ROS packages with compiler sanitizers

websec-examples

Some trivial examples for web vulnerabilities

gccweverything

getacmeaccount

Get account ID and other account info with private key for ACME account

whichmicroarch

Shell script to guess CPU microarchitecture for latest CFLAGS

wolfoverflow

poc for stack buffer overflow in wolfssl

squirrelpatches

Patches for Squirrelmail

blocklistmaker

Scripts to create compromised key blocklists for the badkeys tool

ros-sanitizer-logs

Logs from ASAN/UBSAN/TSAN tests of ROS

rbltest

Simple script to query mailserver realtime block lists (RBLs)

sanhash

Normalize and hash ASAN/MSAN crash dumps

snallygaster-testdata

Test data for the snallygaster tool

fpracer

File permission race proof of concept

thrusql

Docker image to access German emission data from thru.de

wifiinjection

Collection of Screenshots documenting WiFi Networks injecting content into HTTP pages

getkey

Bruteforce-search private keys in larger files

abusescript

Scripts I've been using to inform owners of hosts affected by security vulnerabilities

acmereflect

quick and dirty check for ACME API endpoints that reflect content

sriutil