17 matches found
cookie_crimes
Extracción de cookies de Chrome sin ser root Esto imprimirá las cookies de Chrome de un usuario. No necesitas su contraseña ni ser root para usarlo. genial genial genial genial genial. Si no eres del tipo de persona que regularmente obtiene la capacidad de ejecutar código en las computadoras de...
teams_dump
PoC para volcar y descifrar cookies en la última versión de Microsoft Teams extract.py solo vuelca sin argumentos extract.exe es solo extract.py empaquetado en un exe teamsdump.py List valores en la base de datos root@kitploit: python.exe .\teamsdump.py teams --list Table: meta Columns in meta:...
SharpChromium
SharpChromium Introducción SharpChromium es un proyecto .NET 4.0+ CLR diseñado para recuperar datos de Google Chrome, Microsoft Edge y Microsoft Edge Beta. Actualmente es capaz de extraer: Cookies en formato JSON Historial con las cookies asociadas a cada elemento del historial Inicios de sesión...
CVE-2024-44000-LiteSpeed-Cache
PoC Exploit de LiteSpeed Cache CVE-2024-44000 CVE-2024-44000 es una vulnerabilidad en el plugin LiteSpeed Cache, un popular plugin de WordPress. Esta vulnerabilidad afecta la gestión de sesiones en LiteSpeed Cache, permitiendo a los atacantes obtener acceso no autorizado a datos sensibles. El...
CVE-2024-44000
ES GenCookieSessionHijack es una herramienta PoC diseñada para explotar registros de depuración expuestos de forma insegura en sitios WordPress y extraer cookies de sesión. Esto permite al atacante secuestrar sesiones activas de administrador y obtener acceso no autorizado al panel de...
GlobalUnProtect
GlobalUnProtect Herramienta PoC para descifrar y recopilar la configuración de GlobalProtect, cookies y archivos HIP de instalaciones de cliente en Windows. Entrada de blog: https://rotarydrone.medium.com/4a1d8fc7773e Uso Ejecutar como standalone o en memoria mediante execute-assembly o...
DumpChromeSecrets
!IMPORTANT Este proyecto ya no recibe mantenimiento. Por favor, usaDumpBrowserSecrets en su lugar, que es compatible con Chrome, Edge, Brave, Firefox, Opera, Opera GX y Vivaldi. DumpChromeSecrets Extrae datos de versiones modernas de Chrome, incluyendo tokens de actualización, cookies, credencial...
EUVD-2001-0001
Malware in sbrugna...
CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL
code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...
CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL
code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to a...
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Summary A maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Details Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL https:///proxy/[email protected]/path would be...
MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection", 'Description' = %q This module exploits a universal cross-site...
Exploit for Improper Input Validation in Paloaltonetworks Pan-Os
CVE-2024-3400-pot Simple honeypot for CVE-2024-3400 Palo Alto...
Cross site scripting
An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when...
Chrome Cookie Extraction
Extract cookies from Chrome using Chrome’s Remote Debugging Protocol Recent assessments: 0xEmma at March 15, 2020 7:03pm UTC reported: Although this can lead to cookie leaks, the typical session cookie expires. And the complexity of this attack requires local access to a system, which, generally...
vBulletin vBay <=1.1.9 Error-Based SQL Injection
Exploit for php platform in category web applications !/usr/bin/env python -W ignore::DeprecationWarning """ VBay input variable "type" being assigned with the datatype NOHTML. Using this data type allows malicious attacks to still be executed. At line 448, it is used within the insert into...
