shekkbuilder / polyglot

A detailed compilation of polyglots [techniques, tools and resources] for offensive and defensive security (malware, incident response, steganography, red team)

• Funky File formats - Ange Albertini 2014/12 31C3 - https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2562/original/Funky_File_Formats.pdf

• https://github.com/corkami/pocs/tree/master/poly

• https://code.google.com/archive/p/corkami/

• Scattered - sha1 - https://shattered.io/static/shattered.pdf

• https://truepolyglot.hackade.org/

• Exploit Delivery via Steganography and Polyglots - https://stegosploit.info/

• Polyglots: Crossing Origins by Crossing Formats - http://www.cse.chalmers.se/~andrei/ccs13.pdf

• Hide Android Applications in Images - https://www.blackhat.com/docs/eu-14/materials/eu-14-Apvrille-Hide-Android-Applications-In-Images-wp.pdf

• GIF/Javascript Polyglots: Abusing GIFs, tags, and MIME types for evil - https://0x00sec.org/t/gif-javascript-polyglots-abusing-gifs-tags-and-mime-types-for-evil/5088

• PDF-based polyglots through SVG images - https://es.slideshare.net/mindedsecurity/pdfbased-polyglots-through-svg-images

• Bypassing Content Security Policy with a JS/GIF Polyglot - https://ajinabraham.com/blog/bypassing-content-security-policy-with-a-jsgif-polyglot

• Malvertising Attack Sneaks JavaScript Payload in Polyglot Images - https://www.bleepingcomputer.com/news/security/malvertising-attack-sneaks-javascript-payload-in-polyglot-images/

• Bypassing CSP using polyglot JPEGs - https://portswigger.net/blog/bypassing-csp-using-polyglot-jpegs

• Unleashing an Ultimate XSS Polyglot - https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot

• https://www.peerlyst.com/posts/polyglot-payloads-xss-hari-namburi

• Building an XSS polyglot through SWF and CSP - https://labs.detectify.com/2015/05/28/building-an-xss-polyglot-through-swf-and-csp/

• SHAKESPEARE IN A ZIP IN A RAR, HIDDEN IN AN IMAGE ON TWITTER - https://hackaday.com/2018/11/07/shakespeare-in-a-zip-in-a-rar-hidden-in-an-image-on-twitter/#more-332063

• Hacking group using Polyglot images to hide malvertising attacks - https://devcondetect.com/blog/2019/2/24/hacking-group-using-polyglot-images-to-hide-malvertsing-attacks

• https://hatching.io/blog/lnk-hta-polyglot

• https://en.wikipedia.org/wiki/Gifar

• https://github.com/Polydet/polyglot-database

• https://github.com/ViGrey/3F.py

• https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/bmp_polyglot.rb

• https://github.com/tickelton/ico-pdf

• https://webassembly-security.com/polyglot-webassembly-module-html-js-wasm/

• https://github.com/Mr-Un1k0d3r/DKMC/blob/master/DKMC%20presentation%202017.pdf

• +- https://kalilinuxtutorials.com/pixload-image-payload-creating-injecting/

• Polyglots PoC using radare2 as binary editor, Abraham Pasamar, INCIDE - https://www.youtube.com/watch?v=0S61uzx-Efk&feature=youtu.be

• Polyglottar, un polyglot TAR+ELF - https://sysfatal.github.io/polyglottar.html

• https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html

• https://github.com/DavidBuchanan314/tweetable-polyglot-png

• https://github.com/mindcrypt/powerglot