freeradius-server

The FreeRADIUS server Introduction The FreeRADIUS Server Project is a high performance and highly configurable multi-protocol policy server, supporting RADIUS, DHCPv4 DHCPv6, DNS, TACACS+ and VMPS. It is available under the terms of the GNU GPLv2. Using RADIUS allows authentication and...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

c41n

c41n c41n es una herramienta automatizada para configurar Puntos de Acceso Rogue. c41n proporciona la configuración automatizada de varios tipos de Puntos de Acceso Rogue y ataques de Gemelo Malvado. c41n configura un punto de acceso con características definidas por el usuario interfaz, nombre y...

wifi-monitor

wifi-monitor Muestra las IPs de tu red local que están enviando más paquetes ack = acuse de recibo o acuse de recibo de bloque de trama de control 802.11 req = solicitud de envío de trama de control 802.11 clear = listo para enviar de trama de control 802.11 data = QoSData o Data Opciones: -j:...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

DHCPig

DHCPig Validación de endurecimiento DHCP para whitehat: agota un pool, secuestra las concesiones de los vecinos, expulsa hosts de sus direcciones con ARP falsificado y reporta si la red te lo impidió. Requiere root y Python 3.11+. Ejecutar la interfaz web Debian / Kali: descarga el .deb más...

habu

Habu Kit de Hacking Estoy desarrollando Habu para enseñar y aprender algunos conceptos sobre Python y Hacking de Redes. Algunas técnicas implementadas en la versión actual son: Envenenamiento ARP y Sniffing Descubrimiento DHCP e Inanición Identificación de Subdominios Clonación de Certificados...

yersinia

Spanning Tree 1: DOS attack sending conf BPDUs root@kitploit: Let's send some conf BPDUs claiming be root!!! By sending continously conf BPDU with root pathcost 0, randomly generated bridge id and therefore the same root id, and some default values for other fields, we try to annoy the switches...

SharpSniper

SharpSniper Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires...

CVE-2020-7461

CVE-2020-7461 PoC for DHCP vulnerability NAME:WRECK in FreeBSD For educational purposes only Environment Host: macOS 11.2.1 Vagrant: 2.2.15 Victim: FreeBSD 12.1-STABLE r364849 Attacker: Ubuntu 20.04 Disclaimer This PoC will cause DoS instead of RCE to prevent abuse. PoC Turn off DHCP server in...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Authors: Moshe Kol, Shlomi Oberman Reproducer PoC for FreeBSD dhclient heap-based buffer overflow vulnerability when parsing DHCP option 119 CVE-2020-7461. The problem resides in the function findsearchdomainnamelen in the file sbin/dhclient/options.c. This function i...

dhcpoptinj

DHCP 选项注入器 你是否曾想截获 DHCP 请求，并在发送者不知情的情况下悄悄塞入几个额外的 DHCP 选项？大概率没有。不过，如果真有此需要，dhcpoptinj 将（但愿能）帮到你。 为什么 篡改 DHCP 请求的原因可以有很多，尽管更可能的是你应该寻找一个更好的方法来解决你的问题。也许你无法访问 DHCP 服务器/客户端，却需要修改它们的 DHCP 选项；也许 DHCP 软件难以配置（或不支持你需要做的事情）；也许你有一个非常复杂和/或特殊的设置；又或者你只是想尝试发送畸形或错误格式的选项？dhcoptinj 还是有一点点可能真的派上用场。 如何工作 dhcpoptinj...

dhcpoptinj

DHCP option injector Have you ever wanted to intercept DHCP requests and squeeze in a few extra DHCP options, unbeknownst to the sender? Probably not. However, should the need ever come, dhcpoptinj will hopefully help you. Why There can be many a reason to mangle DHCP requests, although chances a...

CVE-2026-51718

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51694

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

FEP3370-advanced-ethical-hacking

DynoRoot CVE-2018-1111 Final project for the course Advanced Ethical Hacking at KTH, Stockholm This project demonstrates a known vulnerability of Fedora and RedHat machines related to an unsafe client-side implementation of the Dynamic Host Configuration Protocol DHCP. A rogue DHCP server can cra...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...