ls ~/security

Security & cybersecurity

• secVM-Ghost[code]

  VirtualBox VM detection evasion tool. Modifies DMI, BIOS, disk, GPU, MAC and PCI chipset with real hardware profiles so systeminformation and similar tools do not flag the environment as virtual. Scripts for Windows, Linux and macOS (Intel and Apple Silicon). Use case: anti-fraud analysis, research and testing software that blocks virtualized environments.

• secvm-spoofer[code]

  Tool complementary to VM-Ghost focused on evading systeminformation. Applies real hardware profiles (DMI, BIOS, disk, GPU, MAC and PCI chipset) to VirtualBox virtual machines. Cross-platform scripts for Windows, Linux and macOS (Intel and Apple Silicon).

• secprocess-cloak[web][code][images]

  Offensive and defensive cybersecurity tool that renames running processes with operating system service names, making them invisible to standard process scanning. Useful for red teaming, EDR evasion and detection testing. Dual Linux and Windows support.

• secXSS2Shell[code][images]

  An educational proof of concept of the XSS2Shell chain (CVE-2026-64638): a pre-auth reflected XSS in wp-login.php affecting all WordPress Core versions before 7.0.3 (CVSS 8.9), shipped as an emergency security release in August 2026. It demonstrates going from an XSS to remote code execution. Includes a reproducible Docker lab, a Python attacker server, a technical analysis of the chain and mitigation. For educational and research purposes only.

• secCopyEscape[code][images]

  An educational proof of concept of the CopyEscape chain (CVE-2026-17106): a TOCTOU race condition in the tar extraction of docker cp (a Docker CLI bug, patched in 29.7.0) lets a container without extra capabilities write arbitrary files on the host through an absolute symlink with an atomic rename(2) pivot and rollback. The Linux variant overwrites /usr/bin/runc and achieves root code execution; the macOS variant is a harmless demo that writes ~/pwnd. Includes an LD_PRELOAD, an inotify monitor and a reproducible Docker lab. For educational and research purposes only.

• secGeoLeak[code][images]

  An educational proof of concept of the GeoLeak chain (CVE-2026-52715): an unauthenticated SQL injection (CWE-89) in the gmw_get_locations_within_boundaries_sql() function of the GEO my WordPress plugin, affecting all versions <= 4.5.5 and patched since 4.5.5.1 (June 15, 2026). With read access to any public page using the [gmw] shortcode, an attacker injects arbitrary SQL through swlatlng/nelatlng with no cookies or nonce: forcing measurable delays with SLEEP() (time-based), using the "total_results":N oracle embedded by the plugin in the map JSON (boolean-based) and exfiltrating the whole database char by char while bypassing the no-comma restriction (PHP splits the value with explode(",")) via CASE WHEN and SUBSTRING(x FROM n FOR 1). Includes a self-contained Docker lab (WordPress 6.8 + MariaDB 11), a technical analysis of the chain and of the official 4.5.5.1 patch. For educational and research purposes only.