CVE-2022-22978

CVE-2022-22978 Spring Security Pass Spring Security 成功 http://localhost:9090/login%0a Pass Spring Security with SayMyName 失敗 http://localhost:9090/name%0d Bypass Spring Security with Custom RBAC 失敗 http://localhost:9090/admin/admin%0d Bypass Spring Security with Annotation RBAC 失敗...

tesseract

Unit Testing for Tesseract Requirements Files and structure ├── langdatalstm │ ├── common.punc │ ├── common.unicharambigs │ ├── desiredbigrams.txt │ ├── eng │ │ ├── desiredcharacters │ │ ├── eng.config │ │ ├── eng.numbers │ │ ├── eng.punc │ │ ├── eng.singlestext │ │ ...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling For educational purposes only Setup $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Confirm /admin is denied. $ curl...

padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

br0w

br0w Hack The Br0w | Play your browser and learn more, hack fun !! The Br0w is a simple web to learn about and about web security with a browser as a tool that sometimes people forget about more benefits. Maybe it's more like Capture The Flag CTF. One of the challenges is, disable css and base64...

JDSer-ngng

JDSer-ngng A Burp Extender plugin, that will deserialized java objects and encode them in XML using the Xtream library. Why? This release fixes the bug in the other implementation in JDSer-ng which didn't actually allow modification of the request. Also extends it further, allowing proper use of...

DoodleCloud

DoodleCloud ☁️ Turn Instagram into your personal, infinite cloud storage. DoodleCloud is a Proof-of-Concept PoC tool that uses Instagram's internal API to store unlimited files for free. By converting files into "Visual Noise" images and uploading them as DM doodles, we can bypass file type...

Sleipnir

Sleipnir Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Dave Spencer, david dot spencer at nccgroup dot com http://www.github.com/nccgroup/Sleipnir Released under AGPL see LICENSE for more information Description Sleipnir is a small executable designed for quick...

CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector Description Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. Vulnerability exists in...

json-sanitizer

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...

xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

Steganography

Steganography Table of Contents Installation Byte Sequence Manipulation WavSteg LSBSteg StegDetect If you are unfamiliar with steganography techniques, I have also written a basic overview of the field in Steganography: Hiding Data Inside Data. Installation This project is on PyPI and can be...

CVE-2019-13292-WebERP_4.15

Blind SQL Injection Exploit for WebERP This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15, initially discovered by Semen Alexandrovich Lyhin on June 10, 2019. The original exploit can be found here, and further details regarding th...

cook

COOK An overpowered wordlist generator, splitter, merger, finder, saver, create words permutation and combinations, apply different encoding/decoding and everything you need. Frustration killer! & Customizable! Index Installation Configuration Basic Ranges Param Approach COOK's Ingredients...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Interactive shell HTTP hijack + POST + AES-256-CBC/BASE64 Detection -dnslog DNSLog No-Output Detection Nuclei -poc Vulnerability Echo Detection Exploitation -exp Interactive shell base64 echo -exp2 Interactive shell HTTP hijack + POST + Base64 -exp3...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 Security Issue Mitigation Script Description This repository contains a Bash script to check and mitigate the buffer overflow vulnerability identified in GNU libc glibc versions 2.39 and older, known as CVE-2024-2961. This vulnerability affects PHP when the iconv...

flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

CaptfEncoder

CaptfEncoder English | 中文 | V1 | V2 Captfencoder is a opensource rapid cross platform network security tool suite, providing network security related code conversion, classical cryptography, cryptography, asymmetric encryption, miscellaneous tools, and aggregating all kinds of online tools...

CVE-2025-32023

CVE-2025-32023 PoC & Exploit for CVE-2025-32023 GHSA-rp2m-q4j6-gr43 / PlaidCTF 2025 "Zerodeo" Repro / Patch Tested against redis:7.4.2-alpine3.21@sha256:02419de7eddf55aa5bcf49efb74e88fa8d931b4d77c07eff8a6b2144472b6952 Affects Redis versions = 2.8. Patched on 8.0.3, 7.4.5, 7.2.10, 6.2.19, see...