WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials

WAPPLES Web Application Firewall through 6.0 contains a hardcoded credentials vulnerability. It contains a hardcoded system account accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wccautoscaling.py file. An attacker can use this account to access system configuration and...

Huawei Firewall - Local File Inclusion

USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gai...

Zyxel - Cross-Site Scripting

Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mpidx...

Cisco Secure Firewall Management Center - Authentication Bypass

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. id: CVE-2026-20079 info: name: Cisco Secure...

Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

web-application-firewall-

Simulación de Cortafuegos de Aplicaciones Web Descripción general Este proyecto demuestra una simulación de un Cortafuegos de Aplicaciones Web WAF utilizando Flask y un verificador de vulnerabilidades para CVE-2017-5638. El middleware WAF bloquea solicitudes HTTP que contienen patrones específico...

CVE-2022-4539

Consideraciones de uso: Adaptabilidad: Puede modificar fácilmente las cargas útiles, la lógica de generación de IP y los proxies para adaptarse a diferentes escenarios o entornos. Uso ético: Asegúrese de tener permiso explícito antes de probar cualquier sistema con este código. Escalabilidad: Est...

Block-Spring4Shell

Project Spring4Shell CVE-2022-22965 Blocker Firewall Server Handler - This project is a proof-of-concept POC firewall server designed to detect and block attacks exploiting the CVE-2022-22965 vulnerability, commonly known as Spring4Shell. The server inspects incoming HTTP requests and blocks any...

fortinet-fortiweb-cve-2025-64446-58034

Comprendiendo las vulnerabilidades de Fortinet FortiWeb CVE-2025-64446, CVE-2025-58034 1. Resumen Fortinet FortiWeb es un dispositivo Web Application Firewall WAF ampliamente implementado en los sistemas empresariales para proteger las aplicaciones web frente a amenazas comunes. Dado que FortiWeb...

CVE-2024-30973

CVE-2024-30973 - V-SOL G/EPON ONU - HG323AC-B Elemento de Descripción: root@kitploit: Item: G/EPON ONU Specification: HG323AC-B Device model XPON+2GE+1POTS+2WIFI+USB Device SN 70B64F-1234570B64F0C2C0C Hardware Version V1.0 Firmware Version V2.0.08-210715 PON S/N GPON000C2C0C Tipo de...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

cve-2022-1040

Entorno En el entorno de Python 3.10 root@kitploit: It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall...

EVIL-CVE-2021-23017-Update-2025

vulnerabilidad en servidores NGINX versiones 0.6.18–1.20.0. Los scripts tienen como objetivo causar una Denegación de Servicio DoS mediante el envío de respuestas DNS maliciosas, con mejoras para evadir firewalls. Esta es una versión mejorada del PoC original de M507/CVE-2021-23017-PoC. Advertenc...

malvinci

malvinci This simple script will introduce a new type of malware that will turn off the firewall, start an HTTP server, forward its port through ngrok, and send the URL of the server through a Telegram bot. You will need to create a new Telegram BOT. Follow the steps the steps here to create one⚡...

ssct

ShadowSocks ConnecTion 방화벽을 지속적으로 우회하기 위한 shadowsocks 래퍼 도구입니다. 빠른 시작 자동 연결 이 도구를 실행하는 가장 쉬운 방법은 터미널에 ssct를 입력하는 것입니다. 그러면 ssct가 ishadowsocks에서 사용 가능한 shadowsocks 서버를 가져와 자동으로 연결합니다. 특정 서버에 연결 먼저 --list 옵션으로 모든 ss 서버를 표시합니다. root@kitploit: ssct --list 그런 다음 -n 옵션으로 특정 서버에 연결합니다. root@kitploit: ss...

waf-community-bypasses

Bypasses comunitarios de WAF Los Web Application Firewalls a.k.a. WAF son una basura. Todos los proveedores, desde el Cloudflare más barato hasta los "enterprise" como Imperva, Akamai, F5, Checkpoint o Fortinet solo están engañando a sus clientes al ofrecer 0 protección real. El 99.9% de las firm...

isowall

isowall これは、対象デバイスをローカルネットワークから完全に隔離するミニファイアウォールです。感染したマシンにインターネットアクセスを許可する一方で、ローカルネットワークを危険にさらさないためのものです。 ビルド このプロジェクトは libpcap と、もちろんCコンパイラに依存しています。 Debianでは、以下でうまくいくはずです。 root@kitploit: apt-get install git gcc make libpcap-dev git clone https://github.com/robertdavidgraham/isowall cd isowall...

Securekit

Securekit Securekit protege lo que tus modelos ejecutan—en cualquier sistema de IA. Securekit es un núcleo de seguridad agnóstico de protocolo para la ejecución de herramientas de IA. Se sitúa entre cualquier sistema LLM o de agentes y las herramientas que utilizan, imponiendo ejecución de...

ICMPTunnel

icmptunnel es una herramienta para tunelizar tráfico IP dentro de paquetes ICMP de solicitud y respuesta de eco ping. Está pensada para evadir firewalls de forma semicubierta, por ejemplo al pivotar dentro de una red donde ping está permitido. También puede ser útil para la salida desde una red...