LFI-aiohttp-CVE-2024-23334-PoC

LFI-aiohttp-CVE-2024-23334-PoC A Bash script to automate Local File Inclusion LFI attacks on vulnerable aiohttp servers, specifically targeting CVE-2024-23334. This exploit allows for unauthorized access to arbitrary files on systems running affected versions of aiohttp with improperly configured...

Adalanche

Adalanche Open Source Visualiseur et explorateur de graphes d'attaque Adalanche fournit des résultats instantanés, en vous montrant les permissions que les utilisateurs et les groupes possèdent dans un Active Directory. Il est utile pour visualiser et explorer qui peut prendre le contrôle de...

CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...

CVE-2015-3306

CVE-2015-3306 ProFTPD Exploit This repository contains a Python proof-of-concept PoC exploit for CVE-2015-3306 ⚠️ Warning: Only use this against systems you own or have explicit permission to test. Unauthorized exploitation is illegal. Author Mohamed EL-KHAROUATI Part 1: CVE-2015-3306 ProFTPD...

CVE-2024-23334-PoC

CVE-2024-23334-PoC Доказательство концепции уязвимости LFI в aiohttp 3.9.1. Опция 'followsymlinks' может использоваться для определения, следует ли следовать символическим ссылкам за пределами корневого статического каталога. Когда 'followsymlinks' установлено в True, проверка того, что чтение...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

CVE-2018-3760

CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: curl -v...

CVE-2020-17518

Apache Flink directory traversal vulnerability, allows remote file read/write via REST API Vulnerability ID: CVE-2020-17518 Vulnerability Description: CVE-2020-17518: Write remote files via REST API Affected Versions: Flink 1.5.1-1.11.2 Safe Versions: Flink 1.11.3 or Flink 1.12.0 Flink 1.5.1...

SolarWinds-CVE-2021-35250

SolarWinds-CVE-2021-35250 Serv-U v.15.3.0.X CVE-2021-35250-Directory-Traversal Hello everyone This is my first POC, don't judge strictly. Disclaimer The author of this repository is not responsible for any damage caused by the use or misuse of these PoC exploits. These PoCs are intended for...

CVE-2022-26923-Powershell-POC

CVE-2022-26923-Powershell-POC A powershell poc to load and automatically run Certify and Rubeus from memory. How it works? 1. Loads Certify.exe and Rubeus.exe in memory. 2. Scans the target machine for misconfigured certificate templates. more on https://www.youtube.com/watch?v=HBRCI5O35R8 3...

gssapi-abuse

gssapi-abuse gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directo...

CVE-2022-23342

CVE-2022-23342 Security Advisory – Username Enumeration in OnBase Affected software versions and builds: OnBase Application Server OnBase releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are impacted. Fixed software versions and builds: OnBase EP3 releases great...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

CVE-2024-28995

CVE-2024-28995 PoC SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Queries Shodan: product:"Rhinosoft Serv-U httpd" "Serv-U FTP Server" Fofa: app="SolarWinds-Serv-U-FTP" References...

CVE-2024-28995-Nuclei-Template

CVE-2024-28995 Nuclei Template Checks for directory traversal vulnerability in Serv-U versions 15.4.2 and below, which allows reading sensitive files like /etc/passwd. Template Details id: CVE-2024-28995 info: name: Serv-U Directory Traversal Vulnerability author: Hüseyin TINTAŞ severity: high...

apache-flink-directory-traversal.nse

This repository does not have a README...

dirsearch

DirSearch Ce logiciel est une implémentation en Go de l'outil dirsearch original écrit par Mauro Soria. DirSearch est le tout premier outil que j'écris en Go, principalement pour jouer et expérimenter avec le modèle de concurrence de Go, les canaux, etc. : Objectif DirSearch prend une URL d'entré...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 Elevation of Privilege Vulnerability Description The Modify Computers is a predefined role in ADManager for managing computers. If a technician user has the Modify Computers privilege over a computer, they can change the userAccountControl and...

CVE-2021-23132

CVE-2021-23132 commedia allowed paths that are not intended for image uploads to RCE. CVE-2020-24597 Directory traversal in commedia to RCE Two CVEs are the same. PoC Full Affected version: Joomla core =3.9.24 User requirement: Admin account Not Superadmin Gain access: Create superadmin, then...