This is a Tinyscript wrapper for this Gist, working with Python 2 and 3.
$ pip install tinyscript
$ tsm install evil-pickle-maker
Alex dhondta
This Tinyscript-based tool allows to unhide data hidden in base32/base64 strings. It can take a PNG or JPG in input to retrieve an EXIF value as the input data.
This can be installed using:
$ pip install tinyscript
$ tsm install paddinganograph
This Tinyscript-based tool allows to apply steganography based on PIT (Pixel Indicator Technique) in order to retrieve hidden data from an image.
$ pip install tinyscript
$ tsm install stegopit
This Tinyscript-based tool allows to apply steganography based on LSB (Least Significant Bit) in order to retrieve hidden data from an image.
$ pip install tinyscript
$ tsm install stegolsb
This Tinyscript-based tool allows to apply steganography based on PVD (Pixel Value Differencing) in order to retrieve hidden data from an image.
$ pip install tinyscript
$ tsm install stegopvd
This Tinyscript-based allows to load an email and to parse the receivers, indicating where the found IP addesses originate from.
This can be installed using:
$ pip install ipaddress mail_parser maxminddb-geolite2 tinyscript
$ tsm install get-email-origin
CVE-2019-12761 - Code Injection in Python's xdg Module
A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
CVE-2019-12760 - ACE in Python's parso Module
** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration."
While loading a configuration file, logging/config.py's handler parsing function calls eval() twice on unsanitized variables coming from the configuration file, therefore allowing an attacker to execute arbitrary code.
This is a small tool using Tinyscript for finding the organization associated with a given OUI or MAC address.
$ pip install tinyscript
$ tsm install oui
NewerOlder