CVE-2021-42574

POC of CVE-2021-42574 for solidity and solc compiler

solidity_CVE-2021-42574-POC Jan 31 2023, Altin (tin-z), githubcom/tin-z PoC POC of CVE-2021-42574 for solidity and solc compiler install # solc and select 0817 version (githubcom/crytic/solc-select) # foundry (githubcom/foundry-rs/foundry) deploy contract SOLV=0817 folder_t=test_open mkdir $folder_t &amp

Generate malicious files using recently published bidi-attack (CVE-2021-42574)

CVE-2021-42574 - Code generator // Update: 05112021 It's now possible to not only encode, but also decode files Means that now files containing supported bidi chars can be translated to template files with bidi placeholders (LRO, ) Generate malicious files using recently published bidi-attack vulnerability, which was discovered in Unicode Specification and affects

Generate malicious files using recently published bidi-attack (CVE-2021-42574)

CVE-2021-42574 - Code generator // Update: 05112021 It's now possible to not only encode, but also decode files Means that now files containing supported bidi chars can be translated to template files with bidi placeholders (LRO, ) Generate malicious files using recently published bidi-attack vulnerability, which was discovered in Unicode Specification and affects

CVE-2021-42574_and_CVE-2021-42694

A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks (CVE-2021-42574,CVE-2021-42694)

Unicode Control Characters Action A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool accessredhatcom/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks (CVE-2021-42574,CVE-2021-42694) Inputs args Required The script arguments documented in src/READMEtxt Example usage name: Tests on: push: bra

记录我的2021年

AD 2021 记录下我的2021年。(Inspired by yihong) Github 收藏的博客 序号 博客 备注 1 jimmysongio 云原生技术学习 2 githubcom/Maskhe/javasec Java 安全学习 3 土豆不好吃 好多有趣的东西，极客风 4 safe6 safe6 师傅，web安全，安卓逆向 5 phith0n p牛！ 6 whoami whoami, web， ctfer 7 素18 su18 8 4ra1n

Checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks. See CVE-2021-42574

BIDI Character Detector This tool checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks to mitigate CVE-2021-42574 This tool was written in Rust and is distributed as a small (< 3MB) docker compatible container to allow fast and easy usage For an explanation of the attack, have a look at GitHub's blog entry or the

Trojan Source Exprimenting with CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - (Code generator) — بكل بساطة اختصارا الثغرة عبارة عن ان الكود يكون شكله غير عن يوم تجميعه (: حيث يتمثل الهجوم في استخدام أحرف التحكم المضمنة في التعليقات والسلاسل لإعادة ترتيب أحرف التعليمات

Unicode Comb Recursively scan all files in a directory for insecure Unicode characters Background Re: "bidirectional override" trojansourcecodes/ cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2021-42574 blogrust-langorg/2021/11/01/cve-2021-42574html Re: "HANGUL FILLER" certitudeconsulting/blog/en/invisible-backdoor/ Unsafe

Provides custom lint rules developed by Bottle Rocket Studios to help keep our code cleaner, detect and mitigate possible security issues, and allow us to write rules around best practices and usage as necessary in the future

CustomLintRules What this library does? This library currently provides the following lint rules that detect unsupported characters in source and xml files: TrojanSourceDetector - covers Java and Kotlin files TrojanXmlDetector - covers XML resource and Android manifest files A fatal lint error will be reported if any unicode (or unsupported ascii) characters are detected Onl

Trojan Source Maven Plugin

Trojan Source Maven Plugin This Maven plugin scans your source code for occurrences of trojan source as described on the following page: trojansourcecodes Trojan source attacks use unicode control characters to make evil source code look valid by reordering parts of it For a deeper explanation have a look on the above-mentioned page or even read the paper of Nicholas

Bittide aegir simulator

ægir ægir (Old Norse 'sea') is a multi-level bittide functional simulator ægir functionality includes: defining distributed applications using a simple DSL to construct pipelines of repeatable tasks that follow a synchronous dataflow programming model; purely functional simulation of above distributed applications; functional simulation of distrib