1362 matches found
weebdns
WeebDNS Herramienta de enumeración DNS con asincronía ¿Te gusta C4RR075? DESCÁRGALO SOLAMENTE AQUÍ, NO CONFÍES EN OTROS LUGARES. Este es el repositorio oficial y único del proyecto WeebDNS. Escrito por: FuzzyRabbit - Twitter: @rabbitfuzzy, GitHub: @FuzzyRabbit DESCARGO DE RESPONSABILIDAD: Esto es...
CVE-2024-23334
CVE-2024-23334 :; 他人的漏洞利用分析 审查他人发布的漏洞利用 滥用时本人负责 滥用后果自负 https://nvd.nist.gov/vuln/detail/CVE-2024-23334 安装install python -m pip install --upgrade pip requirements.txt aiohttp==3.9.1 pip install -r requirements.txt pip show aiohttp test version Version 3.9.1 点击图片即可播放 YouTube 再现视频 Play...
aiohttp - Directory Traversal
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
LFI-aiohttp-CVE-2024-23334-PoC
LFI-aiohttp-CVE-2024-23334-PoC 一个Bash脚本，用于自动化对易受攻击的aiohttp服务器进行本地文件包含（LFI）攻击，专门针对CVE-2024-23334。该漏洞利用允许在运行受影响版本且静态路由配置不当的aiohttp系统上，未经授权访问任意文件。 CVE-2024-23334 漏洞 CVE-2024-23334 漏洞影响基于Python和asyncio的异步HTTP客户端/服务器框架aiohttp。当aiohttp被用作Web服务器并配置静态路由时，若配置不当，可能导致目录遍历漏洞，从而允许攻击者未经授权访问系统上的任意文件。 此漏洞的缓解措施 包...
aiohttp-exploit-CVE-2024-23334-certstream
从certstream.calidog.io 收集域名。 检查响应头中是否存在Python aiohttp。 尝试利用 CVE-2024-23334 成功的尝试通过 webhook 发送到 discord。...
CVE-2024-23334
CVE-2024-23334 漏洞利用和概念验证 本仓库包含 CVE-2024-23334 的概念验证 PoC 漏洞利用代码，展示了某 Web 应用程序中允许未授权访问服务器敏感文件的漏洞。PoC 包含一个容器化的 Web 服务器和一个用于检测漏洞的漏洞利用脚本。 仓库结构 root@kitploit: . ├── .gitattributes ├── .git/ ├── Dockerfile ├── exploit.py ├── requirements.txt ├── server.py ├── static/ │ └── safefile.txt └── test.log 文件和目...
poc-cve-2024-23334
poc-cve-2024-23334 此仓库包含关于利用 aiohttp 库中报告漏洞 CVE-2024-23334 的概念验证。 创建此仓库出于两个原因： 1. 教育目的 ：对于刚接触应用安全的人来说，有助于了解复现漏洞的步骤以及理解背后的概念。 2. 修复步骤 ：分享缓解措施以解决该问题。 更多信息，请访问我的网站：https://brianre.dev/ 要求 安装 Docker 安装 Python3 如何本地运行项目 1. 将此仓库克隆到本地。 2. 运行以下命令构建镜像： root@kitploit: make build 3. 运行以下命令启动容器： root@kitploi...
CVE-2024-23334-PoC
CVE-2024-23334-PoC 此仓库是 CVE-2024-23334 的概念验证（POC），演示了尝试复现 aiohttp 中导致本地文件包含（LFI）的漏洞。 !CAUTION 免责声明：此 POC 仅用于教育目的。请勿在真实场景中使用。 安装 1. 克隆仓库并设置环境。 root@kitploit: git clone https://github.com/Betan423/CVE-2024-23334-PoC cd CVE-2024-23334-PoC run in virtual environment python3 -m venv .env chmod +x...
CVE-2024-23334-PoC
CVE-2024-23334-PoC Python AioHTTP 库（版本 = 3.9.1）中路径遍历漏洞的概念验证 请确保找到一个有效的公开目录，例如 "/static/" 或 "/assets/" 找到后，进入 main.py 并将 /static/ 字符串替换为你找到的目录。...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...
ROOT-APP-PYPI-CVE-2026-54277 CVE-2026-54277 in aiohttp - Patched by Root
Root has patched CVE-2026-54277 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-69227 CVE-2025-69227 in aiohttp - Patched by Root
Root has patched CVE-2025-69227 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-50269 CVE-2026-50269 in aiohttp - Patched by Root
Root has patched CVE-2026-50269 in the aiohttp package for Root:PyPI. Multiple fixed versions available...