333861 matches found
LFITester
DISCLAIMER • This tool is for educational purposes only. • The developers and collaborators are not responsible for any illegal usage of this tool. LFITester LFITester is a Python3 tool which tests if a server is vulnerable to Local File Inclusion LFI attacks. It runs in Linux/Unix systems but it...
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...
NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address (RIP) Control
NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address RIP Control """NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address RIP Control""" from future import annotations from kittysploit import import os import socket import ssl import sys...
IceWarp Server Static Route External Filter UNC DLL Remote Code Execution — Detect
Fingerprint / reachability check for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for IceWarp Server Static Route External Filter UNC DLL Remote Code Execution""" from kittysploit import from...
DrayTek Vigor uploadlangs command injection root RCE
Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE.""" from future import annotations import uuid from kittysploit import from...
CIRCUTOR PowerStudio JWT alg=none forgery
Forge alg=none Admin JWT and access protected admin/microservice routes. When events.xml accepts the token, delivers shellExecute for Windows cmd/payload. """CIRCUTOR PowerStudio JWT alg=none admin forgery auth bypass chain primitive.""" from future import annotations import base64 import json...
Cisco CUCM Axis fmService exec stage RCE
Final chain stage: SOAP util:exec on /controlcenterservice/services/fmService with Basic axisauth prior SQLi/webshell stages manual. """Cisco CUCM Remote Code Execution Chain""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
Lantronix EDS FsUnmount command injection
Authenticated POST /FsUnmount with newline/breakout in path reaches ltrxusbumount → /bin/sh -c root. !/usr/bin/env python3 -- coding: utf-8 -- """Lantronix EDS FsUnmount path parameter command injection.""" from future import annotations import re from urllib.parse import urlencode from kittysplo...
Opengear NGCS PDU name command injection
Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...
RoboTask REST API unauthenticated task execution
RoboTask REST API default port 9999 with RestUseApiKeys=0 accepts unauthenticated POST /api/tasks/id/run and executes preconfigured task actions with the RoboTask service privilege. !/usr/bin/env python3 -- coding: utf-8 -- """RoboTask REST API unauthenticated remote task execution CWE-306.""" fr...
StreamSets Transformer auth none ScalaDTransform RCE
Unauthenticated /rest/v1 pipeline API: ScalaDTransform stage runs sh -c with attacker command http.authentication=none. """StreamSets Transformer auth none ScalaDTransform anonymous RCE.""" from future import annotations import json import time import uuid from kittysploit import from...
DSE Gremlin-Groovy sandbox bypass RCE
Unauthenticated Gremlin WebSocket: this.evaluate nested ProcessBuilder bypass. """DataStax Enterprise DSE Gremlin-Groovy Sandbox Bypass Unauthenticated RCE""" from future import annotations from kittysploit import import base64 import hashlib import json import os import secrets import socket...
NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST
NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST """NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST""" from future import annotations from kittysploit import import socket import ssl import sys import time import re import os...
Royal Render unauth rrServer job submission RCE
TCP 7773 captured Execute/Once job record no auth. Scene script path embedded in record — write locally only if worker shares that storage. """Royal Render 9.1.26b - Default-Unauthenticated Job Submission on rrServer Port 7773 Reaching a Worker-Side Shell Script Execution as root CWE-306, CWE-118...
Edimax BR-6478AC setWAN command injection root RCE
HTTP Basic auth POST /goform/setWAN — pppUserName/pptpUserName/L2TPUserName injected into system pipeline as root boa User root. """Edimax BR-6478AC setWAN authenticated command injection root.""" from future import annotations import base64 from urllib.parse import urlencode from kittysploit...
CatDV empty admin password aaftoolPath RCE
Login as admin with factory empty password, override aaftoolPath, trigger AAF export optional sshkey to stage /tmp/evil.sh. """CatDV factory-default empty admin password → aaftoolPath root RCE.""" from future import annotations import base64 import json import os import re import subprocess from...
DBxtra .NET unauthenticated SOAP xp_cmdshell RCE
Unauthenticated DBxtraService.asmx chains ProjectConnectionInsertDB, ProjectObjectInsertDB xpcmdshell SQL, UpdateDatabaseVersion, and DataGrid.aspx viewer execution. !/usr/bin/env python3 -- coding: utf-8 -- """DBxtra .NET unauthenticated SOAP xpcmdshell RCE.""" from future import annotations...
Lantronix EDS3000PR SSL passin command injection
Authenticated POST /ssl with certpasswd/keypasswd injected into openssl -passin pass:%s system enables root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Lantronix EDS SSL -passin pass:%s command injection RCE.""" from future import annotations import re import time from...
Cisco CUCM Remote Code Execution Chain — Detect
Fingerprint / reachability check for Cisco CUCM Remote Code Execution Chain !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Cisco CUCM Remote Code Execution Chain""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...
