6527 matches found
bonesi
BoNeSi BoNeSi , the DDoS Botnet Simulator is a Tool to simulate Botnet Traffic in a testbed environment on the wire. It is designed to study the effect of DDoS attacks. What traffic can be generated? BoNeSi generates ICMP, UDP and TCP HTTP flooding attacks from a defined botnet size different IP...
Pummel
██████╗ ██╗ ██╗███╗ ███╗███╗ ███╗███████╗██╗ ██╔══██╗██║ ██║████╗ ████║████╗ ████║██╔════╝██║ ██████╔╝██║ ██║██╔████╔██║██╔████╔██║█████╗ ██║ ██╔═══╝ ██║ ██║██║╚██╔╝██║██║╚██╔╝██║██╔══╝ ██║ ██║ ╚██████╔╝██║ ╚═╝ ██║██║ ╚═╝ ██║███████╗███████╗ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝ Disclaimer:...
hyenae-ng
Hyenae NG Hyenae NG Next Generation is a re-write of the original Hyenae tool which was originally published back in the year 2010. Besides switching from C to C++, using modern design concepts, Hyenae NG was just like the original Hyenae written with maximum portability in mind. Since the origin...
EvilNet
EvilNet install : sudo pip3 install -r requirements.txt EvilNet Attack Network Scan Network Wifi Attack ARP Attack Brute Force Attack protocol !EvilNetattackhttps://raw.githubusercontent.com/Matrix07ksa/EvilNet/master/ev...
network-attacker
Network-Attacker network-attacker V0.1 is a Wifi Stress Testing Bash Script Program Based on Mdk3 Beacon Flooding & Deauthentication Attack Created To Help Beginners And even Professionals For a beacon Flooding Or Deauthentication Attack On Networks Installation sudo apt-get install git sudo git...
CVE-2023-44487-
CVE-2023-44487- 1- Install Go. 2- Run the server on one seperate machine server.go file 3- Execute the main.go file on a separate machine. Note: main.go contains the attack code. 4. Specify the IP address of the target. 5- Define the number of requests: run main.go -requests 5000...
CVE-2025-31650
Apache Tomcat 10.1.39 - Denial of Service DoS This tool performs a high-volume, asynchronous HTTP/2 request flood using malformed priority headers to test the stability of Apache Tomcat servers running version 10.1.10 to 10.1.39. ⚠️ This is strictly for educational and research purposes only. ❌ Th...
CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...
CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...
CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...
CVE-2026-119701
The WPGraphQL plugin (versions prior to 2.24.1 ) is vulnerable to an email flooding attack due to a missing rate limiting flaw. Unauthenticated attackers can exploit the sendPasswordResetEmail mutation by using multiple aliases within a single HTTP request. This technique bypasses the batch_limit...
QUIC-attacks
QUIC-attacks CVE-2022-30591 The current repository serves the purpose of sharing the scripts we used for educational usage. These attacks were a part of our study check here, and were tested against 6 different QUIC-enabled servers IIS, NGINX, LiteSpeed, Cloudflare, H2O, and Caddy. The quic-loris...
IFA
IFA Disk Flooding Attack via IndexedDB IFA is an Proof of Concept PoC that demonstrates how an attacker can exploit the IndexedDB API in popular web browsers to carry out a disk flooding attack. This attack specifically leverages the lack of restrictions in IndexedDB, allowing the browser to stor...
hawk
Hawk Hawk is a network and pentest utility that I developed so that I could perform different kinds of tasks using the same suite, instead of jumping from one tool to another. Currently, this script can perform a variety of tasks such as ifconfig , ping , traceroute , port scans including SYN, TC...
CVE-2016-8610-PoC
CVE-2016-8610 PoC CVE-2016-8610 SSL Death Alert PoC Usage: python ssl-death-alert.py DOMAIN/IP PORT PROTOCOL-VERSIONSSLv3, TLS1.0, TLS1.1, TLS1.2 NUMBER-OF-ALERTS1000 THREADS50 python ssl-death-alert.py test.tdl 443 TLS1.2 1000 50 More info: http://security.360.cn/cve/CVE-2016-8610/...
CVE-2019-16279
CVE-2019-16279 （CVE-2019-16279）dos This bug exploit a memory error when sending too many \r\n in a single connexion. Example $ curl http://127.0.0.1:8080 HELLO! $ ./CVE-2019-16279.sh 127.0.0.1 8080 $ curl http://127.0.0.1:8080 curl: 7 Failed to connect to 127.0.0.1 port 8080: Connection refused...
CVE-2023-22622
DoS WP-Cron - CVE-2023-22622 Exploit PoC Overview This repository contains a script that exploits the CVE-2023-22622 vulnerability in WordPress, causing a Denial of Service DoS via WP-Cron. This script can be used to flood a vulnerable WordPress site with requests, potentially leading to server...
DotNET_XorCryptor
DotNET XorCryptor You can also pay attention to an older project - NET-MalwareCryptor This is a .NET executable packer with payload encryption. Use for educational purposes only. How to use? --file path - specify file name --flood - add junk classes to file --proxy - move original entry point to...
CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...