---

✨ Features

• Single-file PoC — Zero dependencies
• Malicious FTP server mimicking NetWare banner + truncated LIST response
• Real-time detection and decoding of Basic Auth + Bearer tokens
• Multi-threaded heap spraying for faster leaks
• Clean, colored console output with live statistics

---

🚀 Quick Start

git clone https://github.com/0xBlackash/CVE-2026-47729.git
cd CVE-2026-47729

python3 CVE-2026-47729.py --proxy 127.0.0.1:3128

Command Line Options

Argument	Default	Description
--proxy	127.0.0.1:3128	Target Squid proxy (host:port)
--ftp-port	2222	Local evil FTP server port
-t, --threads	4	Number of concurrent polling threads

---

📸 Expected Output

[PoC] Squidbleed CVE-2026-47729 by Ashraf Zaryouh (0xBlackash)

[ 14.78s] [BASIC] cGFzc3dvcmQxMjM6c2VjcmV0
              decoded = admin:password123

[ 18.33s] [BEARER] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

---

🛠️ How It Works

1. Starts an evil FTP server that sends a truncated directory listing.
2. Repeatedly forces Squid to connect via FTP URLs.
3. Triggers the heap buffer over-read → leaks adjacent memory.
4. Extracts credentials and tokens from leaked data.

---

⚠️ Disclaimer

This PoC is for educational and authorized testing purposes only.
Use responsibly on systems you own or have permission to test.

---