CVE-2019-3980

CVE-2019-3980 This repo was created to utilize the Nessus POC with a custom C executable to run commands on a remote host and get the output of the command. The python file is used to start a web server, execute the exploit, and then get the results over the web server. The C exe is uploaded...

TIWAP

Proyecto de Aplicación Web Totalmente Insegura TIWAP TIWAP es un laboratorio de pruebas de seguridad web creado con Flask para entusiastas de la seguridad en ciernes que desean aprender sobre diversas vulnerabilidades web. Inspirado en DVWA, los contribuyentes han hecho todo lo posible por recrea...

nosqlpot

NoSQL-Honeypot-Framework NoPo NoSQL-Honeypot-Framework NoPo is an open source honeypot for nosql databases that automates the process of detecting attackers,logging attack incidents. The simulation engines are deployed using the twisted framework.Currently the framework holds support for redis. N...

goWAPT

GOWAPT - Prueba de Penetración de Aplicaciones Web en Go GOWAPT es el hermano pequeño de wfuzz, una navaja suiza de WAPT. Permite al pentester realizar actividades masivas sin estrés alguno; solo configúralo y todo se reduce a unos clics. Cómo instalar Para instalar gowapt simplemente ejecuta: ma...

CVE-2021-36260-metasploit

CVE-2021-36260-metasploit the metasploit scriptPOC about CVE-2021-36260. A command injection vulnerability in the web server of some Hikvision product, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. preparation POC git...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

cloudspy

CloudSpy Esta es una aplicación web de prueba de concepto construida sobre Frida. Para comenzar: npm install node rel/server.js Luego apunta tu navegador web a http://127.0.0.1:8000/...

PAKURI-THON

PAKURI-THON Pentest Logra Conocimiento Unir Interfaz Rápida - Python PAKURI-THON es una herramienta que apoya a los pentesters con diversas herramientas de pentesting y un servidor C4 comando y control & chat y comunicación. PAKURI-THON puede realizar la mayoría de las operaciones con operaciones...

Vulnerability-assessment

Installation & Usage Bash Copy to Nmap scripts directory sudo cp react2shell-detect.nse /usr/share/nmap/scripts/ Update script database sudo nmap --script-updatedb Single target nmap -p80,443 --script react2shell-detect.nse example.com Important: Use this script only against systems you have...

stegowiper

stegoWiper: A powerful and flexible active attack for disrupting stegomalware Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Pand...

adapt

Resumen ADAPT es una herramienta que realiza Pruebas de Penetración de Aplicaciones Dinámicas Automatizadas para aplicaciones web. Está diseñada para aumentar la precisión, velocidad y confianza en los esfuerzos de pruebas de penetración. ADAPT prueba automáticamente múltiples vulnerabilidades...

XSSTracer

XSSTracer v1.3 by 1N3 @CrowdShield https://crowdshield.com XSSTracer is a small python script that checks remote web servers for Clickjacking, Cross-Frame Scripting, Cross-Site Tracing and Host Header Injection. Usage: ./xsstracer...

cookiescanner

cookiescanner Herramienta para verificar la bandera de cookie en múltiples sitios. Introducción Herramienta creada para facilitar el proceso de verificar la bandera de cookie cuando estamos analizando múltiples servidores web. Si quieres saber por qué podría ser útil esta herramienta?...

dotnetpaddingoracle

dotnetpaddingoracle Small script to check if the .NET web application is vulnerable to padding Oracle This script actually verify if the oracle is present and exploitable, not just if the patch has been installed. usage dotnetpaddingoracle.py -h -t -b -d -s -p PARAMETER Burp request file Perform...

scaredycat

SCAREDYCAT! version 0.1 beta Python script to generate a malicious MP4 file and start a web server hosting a page with the embedded 'video' file on port 8080. This exploits another Stagefright vulnerability, the integer overflow vulnerability CVE-2015-3864, published by Exodus Intelligence. autho...

Clickjacking-Tester

Clickjacking Tester A python script designed to check if the website is vulnerable of clickjacking and creates a poc. Screenshot Usage python3 clickjackingtester.py Example Input python clickjackingtester.py sites.txt sites.txt www.google.com www.turkhackteam.com Output Checking www.google.com -...

phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

pentest_lab

Pentest Lab I'm not actively developing on this anymore, but will fix bugs and look at issues and pull requests. Help is appreciated : This local pentest lab leverages docker compose to spin up multiple victim services and an attacker service running Kali Linux. If you run this lab for the first...

forensicscanner

This repository does not have a README...

CVE-2018-2636

Install $ pip install --user requests argparse unicodedata Info POC for CVE-2018-2636. Usage example python eGw.py -H 127.0.0.1 -P 8080 -i ... Let's get info about server ! Your instance is vulnerable to CVE-2018-2636 ... Links Oracle Critical Patch Update Advisory January 2018 - CVE-2018-2636...