wreckuests

이게 뭐죠? Wreckuests는 HTTP-floodGET/POST를 통해 DDoS 공격을 실행할 수 있는 스크립트입니다. 순수 Python으로 작성되었으며 프록시 서버를 "봇"으로 사용합니다. 물론, 이 스크립트는 만능이 아니며 마우스 클릭 한 번으로 Pentagon/NSA/그 어떤 웹사이트를 마비시킬 수 없습니다. 각 공격은 고유하며, 각 웹사이트마다 취약점을 찾아 익스플로잇해야 합니다. 경고: 이 스크립트는 교육 목적으로만 공개되었습니다! 저자는 사용으로 인해 발생할 수 있는 모든 결과, 손해 또는 손실에 대해 책임을 지...

DSSS

아주 작은 SQLi 스캐너 아주 작은 SQLi 스캐너 DSSS는 100줄 미만의 코드로 작성된 완전한 기능의 SQL 인젝션 취약점 스캐너입니다 GET 및 POST 매개변수 지원. 선택적 설정으로 HTTP 프록시와 함께 HTTP 헤더 값 User-Agent, Referer 및 Cookie를 지원합니다. 실행 예시 $ python3 dsss.py -h Damn Small SQLi Scanner DSSS 100 LoC Lines of Code v0.3a by: Miroslav Stampar @stamparm Usage: dsss.p...

CVE-2023-38545

CVE-2023-38545: Curl脆弱性の概念実証 このリポジトリには、CVE-2023-38545脆弱性をテストするために設計された概念実証（PoC）が含まれています。この脆弱性はcurlユーティリティに影響し、特にバージョン7.69.0から8.3.1の間で、HTTPリダイレクトの処理に関連しています。 前提条件 必要なソフトウェア: curl 機能 ポート1080で動作するSOCKS5プロキシサーバー ポート8000で動作するHTTPサーバー 脆弱性をテストする自動化スクリプト アーキテクチャ PoCは主に2つのコンポーネントで構成されています: SOCKS5プロキシサーバー:...

CVE-2023-47246-EXP

脆弱性の詳細 1. fofa: body="sysaid-logo-dark-green.png" || title="SysAid Help Desk Software" || body="Help Desk software by SysAid" 2. 影響を受けるバージョン: SysAid Server23.3.36 脆弱性の再現 1. スクリプトを実行する: git clone https://github.com/W01fh4cker/CVE-2023-47246-EXP.git cd CVE-2023-47246-EXP pip install -r...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: apollo-router, sccache, ntpd-rs, komodo, linkerd2-proxy...

GHSA-5J98-2G5X-46V6 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, sccache, ntpd-rs...

GHSA-6F2X-V7Q7-M7M5 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, sccache, ntpd-rs...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, sccache, ntpd-rs...

CVE-2023-26360

CVE-2023-26360 使用方法 Usage: python3 script.py endpoint proxyurl ファイルの読み取り...

Admin-Scanner

Admin-Scanner 웹사이트 관리자 패널 찾기 설치 방법? Linux/pc sudo apt install python3 sudo apt install python3-pip sudo apt install git git clone https://github.com/alienwhatever/Admin-Scanner.git cd Admin-Scanner 설치 방법? Termux/Android pkg update && pkg upgrade pkg install python3 pkg install git git clone...

Squid Proxy - HTTP Authentication Credentials Disclosure

Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page e.g. ERRDNSFAIL. id: CVE-2025-62168 info: name: Squid Proxy - HTTP...

Geoserver - Server-Side Request Forgery

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d,aringo-bf severity: high description: GeoServer through 2.18.5 and 2.19.x throug...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

Apache Druid - Server-Side Request Forgery

Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request tha...

LoLLMs WEBUI - Server-Side Request Forgery

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication. id: CVE-2026-33340 info: name: LoLLMs WEBUI - Server-Side Request Forgery author:...

Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting

Etherpad versions 2.1.0 through 3.0.0 reflect the x-proxy-path request header into admin HTML, JavaScript, and CSS responses without sanitization. An attacker can abuse this behavior to inject crafted content into generated resource URLs, enabling cross-site scripting and cache poisoning scenario...

WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

Razvan Stanga Varnish/Nginx Proxy Caching = 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests. id: CVE-2025-62126 info: name:...

Apache HTTP Server - ACL Bypass

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. id: CVE-2024-38473 info: name: Apache HTTP Server - ACL Bypass author: pdteam severity: high...

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

LiteLLM - SQL Injection

LiteLLM 1.81.16 to 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header. id: CVE-2026-42208 info: name: LiteL...