security_articles

securityarticles- V16 연결 비콘의 취약점 v16 Help Flash IoT 비콘 에서 발견된 여러 취약점을 설명하는 글입니다. 이러한 취약점은 비콘의 통신 및 WiFi를 통한 소프트웨어 업데이트 메커니즘에 영향을 미칩니다. 2025년 12월...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk contains an authentication bypass vulnerability caused by improper access control, letting attackers execute protected actions without authentication, exploit requires no special conditions. id: CVE-2025-40552 info: name: SolarWinds Web Help Desk - Authentication Bypass...

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

FreeScout < 1.8.224 - Invite Hash Authorization Bypass

FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invitehash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. id: CVE-2026-53595 info:...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

CVE-2024-57727

CVE-2024-57727 CVE-2024-57727 python poc.py http://target python poc.py https://192.168.32.130 + https://192.168.32.130 is vulnerable 블로그: https://rustlang.rs/posts/simple-help/...

ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

go-dork

go-dork The fastest dork scanner written in Go. There are also various search engines supported by go-dork, including Google, Shodan, Bing, Duck, Yahoo and Ask. Install Usage Basic Usage Flags Querying Defining engine Pagination Adding custom headers Using proxy Chained with other tools Supportin...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

CVE-2024-28987

CVE-2024-28987: SolarWinds Web Help Desk 하드코딩된 자격 증명 취약점 취약한 서버에서 CVE-2024-28987을 악용하기 위한 개념 증명. 블로그 게시물 근본 원인 및 침해 지표는 여기: https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive 사용법 % python3 CVE-2024-28987.py -h usage:...

CVE-2024-28987-POC

설명 : SolarWinds Web Help Desk WHD 소프트웨어는 하드코딩된 자격 증명 취약점의 영향을 받아, 원격의 인증되지 않은 사용자가 내부 기능에 접근하고 데이터를 수정할 수 있습니다. 잠재적 영향 : CVE-2024-28987 악용 시 공격자가 SolarWinds Web Help Desk에 구현된 보안 정책을 우회할 수 있습니다. 이로 인해 민감한 데이터에 대한 무단 접근, 구성 수정, 또는 시스템 무결성을 손상시킬 수 있는 기타 악의적인 행위가 발생할 수 있습니다. Web Help Desk가 기업 및 행정 기...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.3-12.3 인증된 원격 코드 실행 개념 증명 PostgreSQL 데이터베이스 버전 9.3에서 12.3최신 테스트까지 인증된 원격 코드 실행에 취약합니다. 개발 팀에서 자체적으로 취약점으로 간주하지 않더라도, 이를 악용하여 잘못 구성된 시스템에 접근할 수 있습니다. 도움말 메뉴 익스플로잇 예시 참고 자료 NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-9193 CVE Details:...

vuln-chm-hijack

PuTTY 취약점 vuln-chm-hijack CHM 하이재킹을 통한 잠재적 악성 코드 실행 개요 0.70 버전까지는 Windows PuTTY GUI 도구에서 온라인 도움말을 실행하면 도구가 자신의 실행 파일 옆에서 도움말 파일을 찾았습니다. 관련 없는 코드가 파일을 떨어뜨릴 수 있는 디렉터리에서 PuTTY를 실행하는 경우예: 브라우저의 기본 다운로드 디렉터리에서 직접 실행하는 경우, 누군가 putty.chm이라는 파일을 해당 디렉터리에 넣도록 꾸몄다면예: 해당 이름의 다운로드 링크를 클릭하도록 유도 PuTTY는 그것이 실제...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.6.1 원격 코드 실행 인증됨 개념 증명 PostgreSQL 데이터베이스 9.6.1 버전부터는 인증된 원격 코드 실행Authenticated Remote Code Execution에 취약합니다. 개발 팀이 이를 취약점 자체로 간주하지 않더라도, 잘못 구성된 시스템에 접근 권한을 얻는 데 악용될 수 있습니다. 도움말 메뉴 악용 예시 참고 자료 NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-9193 CVE Details:...