HTTP-revshell

Powershell HTTP/S Reverse Shell HTTP-revshell은 레드팀 연습과 침투 테스터를 위한 도구입니다. 이 도구는 http/s 프로토콜을 통해 역방향 연결을 제공합니다. 웹 요청을 통해 피해자 머신을 제어하는 은밀 채널을 사용하여 IDS, IPS, AV와 같은 솔루션을 우회합니다. 참고: 이 도구는 우회 측면에서 유지 관리되지 않습니다. 약간의 수정만으로도 시중의 많은 EDR을 우회할 수 있습니다. server.py 도움말 서버 사용법: root@kitploit: usage: server.py -h...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

Arkhota

Arkhota, 안드로이드용 웹 브루트 포서 무엇인가요? Arkhota는 안드로이드 OS용 웹HTTP/S 브루트 포서입니다. 왜 필요한가요? 웹 브루트 포서는 명백한 이유로 항상 해커의 컴퓨터에 있습니다. 때로는 공격이 빠르거나 최소한의 장치 준비만으로 이루어져야 하는 경우가 있습니다. 또한 전화기는 노트북/컴퓨터보다 주목을 덜 받습니다. 이러한 상황을 위해 Arkhota가 있습니다. 다운로드 APK를 여기에서 다운로드할 수 있습니다. 사용법 설명은 APK의 위에서 아래로 객체 순서대로 나열되어 있습니다. 배너 배너, 버전 및...

UBUNTU-CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

EUVD-2026-79944

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

EUVD-2026-78581

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...

CVE-2026-89025: Improper Handling of Exceptional Conditions

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTPS content. A remote unauthenticated attacker can send a specially crafted HTTPS request to a specific endpoint that is processed incorrectly, causing the...

Linux Distros Unpatched Vulnerability : CVE-2026-90461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90461: Improper Restriction of Communication Channel to Intended Endpoints

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

PT-2026-49898

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. A low privileged attacker with network access via HTTPS can...

CVE-2018-25236: Improper Authentication

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTPS management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests...

CVE-2024-14034: Improper Authentication

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTPS management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTPS requests. Attackers can exploit improper authentication...

DNSdist -- vulnerabilities

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html reports: CVE-2026-0396: HTML injection in the web dashboard CVE-2026-0397: Information disclosure via CORS misconfiguration CVE-2026-24028: Out-of-bounds read when parsing DNS packets via Lua CVE-2026-24029: DN...

CVE-2026-3783: Insufficiently Protected Credentials

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...

EUVD-2024-54079

Malicious code in bioql PyPI...

CVE-2025-50200: Insertion of Sensitive Information into Log File

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which...

CrushFTP 11.3.1 - Authentication Bypass

Exploit Title: CrushFTP 11.3.1 - Authentication Bypass Date: 2025-05-15 Exploit Author: @İbrahimsql Exploit Author's github: https://github.com/ibrahimsql Vendor Homepage: https://www.crushftp.com Software Link: https://www.crushftp.com/download.html Version: =2.28.1 , colorama=0.4.6 ,...

CVE-2024-55594

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests...

CVE-2024-55594

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests...