F-Secure LABS

Timeinator is an extension for Burp Suite that can be used to perform timing attacks over an unreliable network such as the internet.

A PoC Android application that exploits 4 vulnerabilities of the Wind Vision TV streaming application to achieve account takeover.

JXA script to allow programmatic persistence via macOS Calendar.app alerts.

The tool exfiltrates data from Couchbase database by exploiting N1QL injection vulnerabilities.

Example of passing file descriptors into a container to perform a privilege escalation on the host

Scripts that can be used to exploit CVE-2019-15972 which was an Authenticated SQLi issue in Cisco Unified Call Manager (UCM).