5269 matches found
CookieCatcher - Tool to assist in the exploitation of XSS
CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...
nWatch - Tool for Host Discovery, PortScanning and Operating System Fingerprinting
nWatch is a handy tool for host discovery, portscanning and operating system fingerprinting. Demo video Requirements nmap scapy colorama ctypes Installation and execution Install the requirements Then you can download nWatch by cloning the Git repository: git clone...
Apache Struts 2.3.x Showcase Remote Code Execution
!/usr/bin/python -- coding: utf-8 -- Just a demo for CVE-2017-9791 import requests def exploiturl, cmd: print"+ command: %s" % cmd payload = "%" payload += "[email protected]@DEFAULTMEMBERACCESS." payload += "memberAccess?memberAccess=dm:" payload +=...
Apache Struts 2.3.x Showcase - Remote Code Execution (PoC) Exploit
Exploit for multiple platform in category web applications !/usr/bin/python -- coding: utf-8 -- Just a demo for CVE-2017-9791 import requests def exploiturl, cmd: print"+ command: %s" % cmd payload = "%" payload += "email protected@DEFAULTMEMBERACCESS." payload += "memberAccess?memberAccess=dm:"...
TorStat - Tor Statistics
Tor Statistics Requirements ProxyChains Optional - only if you need more features to work Colorama psutil Installation and execution Then you can download smap by cloning the Git repository: git clone https://github.com/suraj-root/TorStat.git cd TorStat/ proxychains python TorStat.py Demo video F...
Directory Traversal
Overview Affected versions of uv-tj-demo resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...
Apache Struts 2.3.x Showcase - Remote Code Execution
!/usr/bin/python -- coding: utf-8 -- Just a demo for CVE-2017-9791 import requests def exploiturl, cmd: print"+ command: %s" % cmd payload = "%" payload += "[email protected]@DEFAULTMEMBERACCESS." payload += "memberAccess?memberAccess=dm:" payload +=...
A week in security (June 19 – June 25)
Last week, we expanded on all the different technologies that Malwarebytes uses to break the attack chain and our Incident Response solution. We also warned you about a Roblox Robux generator scam and a phish targeting customers of Barclays Bank. Below are notable news stories and security-relate...
Robert 0.5 - Multiple Vulnerabilities
Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link : https://github.com/RobertManager/robert/archive/master.zip Live demo :...
Contiki Operating System cc26xx-web-demo Cross-Site Scripting Vulnerability
Contiki Operating System is a small, open source, extremely portable multitasking operating system. cc26xx-web-demo is the application used to connect to cloud services. A cross-site scripting vulnerability exists in the MQTT/IBM Cloud Config page a.k.a. mqtt.html of cc26xx-web-demo in the Contik...
CVE-2017-7296
An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page aka mqtt.html of cc26xx-web-demo. The cc26xx-web-demo features a webserver that runs on a constrained device. That particular page allows a user to remotely configu...
CVE-2017-7295
An issue was discovered in Contiki Operating System 3.0. A use-after-free vulnerability exists in httpd-simple.c in cc26xx-web-demo httpd, where upon a connection close event, the httpstate structure was not deallocated properly, resulting in a NULL pointer dereference in the output processing...
Weblate: Information Disclosure on demo.weblate.org
Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...
demo.silverstripe.org XSS vulnerability
Vulnerable URL: http://demo.silverstripe.org/assets/Uploads/evilsvgfile.svg Details: Description| Value ---|--- Patched:| Yes, at 06.05.2017 Latest check for patch:| 06.05.2017 13:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...
InfectPE - Inject Custom Code into PE File
Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files. Why you need InjectPE? You can test your security products. Use in a phishing campaign. Learn how PE injection works. ...and so on. In the project, there is hardcoded x-code of...
Weblate: Self XSS at translation page through Editor Link at demo.weblate.org
User input is not sanitized properly at Editor link causing self xss. Steps to reproduce 1 Navigate to https://demo.weblate.org/accounts/profile/preferences 2 Provide Editor link as javaScript:alertdocument.cookie;//confirm1; and click on Save 3 Navigate to English Translation page of the project...
Nextcloud: Clickjacking In https://demo.nextcloud.com
Hi Nextcloud, Clickjacking In https://demo.nextcloud.com This Is Zeeshan,An Ethical Hacker, I Have Found A Security Issue In Your Site Clickjacking In nextcloud https://demo.nextcloud.com Page Website is vulnerable to clickjacking! Please Fix It As Soon As Possible Best Regards, Zeeshan Waheed...
Code injection
DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verify SSL certificates...
