CVE-2026-115717

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

doublehop

Doublehop This tool aims to assist in using PowerShell Remoting / WinRM to execute PowerShell commands on remote hosts through WinRM double hop technique. This tool assumes you have internal network and CLI access. Usage doublehop Usage: -c string Command we are executing. -j string Host we are...

Stowaway

Stowaway Stowaway is a multi-hop proxy tool for security researchers and penetration testers. Stowaway lets you proxy external traffic through multiple hops into a target internal network, bypassing access restrictions, building a tree-like node topology, and managing it easily. Thanks for the...

sonar.js

sonar.js A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar....

DBScanner

DBScanner Unauthorized access + weak password batch detection Automatically scan common SQL and No-SQL database scripts on the internal network mysql, mssql, oracle, postgresql, redis, mongodb, memcached, elasticsearch, including unauthorized access and common weak password detection Runs in a...

leprechaun

Leprechaun .-----. / V \ |...| |.....| .-' '-. .-. .-./ .--. |\ /| .-;.-"-.-;;-, =/ . -;,-;, . .-.-. . / ||'-'|| \ ,'--;.\ .;--' // o \ // --.. o '';,//| || : || |\ ;' \ '.\--' |"""""""|// / ':.// ,/\ | '---'| ||| ; Leprechaun ; ;""|""; \ / | '. vonahisec .' .' / \ '. '-,. .,-' --' --' /...

Moodle-CVE-2018-1042

Moodle CVE-2018-1042 Script to exploit CVE-2018-1042 in order to do internal port scans...

peeko

peeko Version: v1.1 peeko is a browser-based XSS-powered C2 Command and Control tool that leverages the victim’s browser as a stealthy proxy inside internal networks. Through an injected XSS payload, peeko establishes a WebSocket connection to a central server, allowing an attacker to remotely...

CVE-2026-33752

CVE-2026-33752 CVE-2026-33752Redirect-based SSRF leading to internal network access in curlcffi Summary curlcffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

pd-agent

ProjectDiscovery Cloud Platform — Agent What it does • Quick Start • Install • Configuration • Scaling What it does pd-agent lets you scan your own internal networks from the ProjectDiscovery Cloud Platform. Install the agent on a machine inside the network you want to scan — a VM, a server, a...

CVE-2026-116069

NiubiGEO versions prior to 0.3.2 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the POST /audit-plan endpoint, where an attacker can provide a crafted domain value to force the server to fetch internal addresses. By submitting IP literals , localhost ...

CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local host...

CVE-2021-36260

Hikvision CVE-2021-36260 RCE Vulnerability Vulnerability Description Attackers can exploit this vulnerability to gain complete control over the device with an unrestricted root shell, even if the device owner is limited to a restricted protected shell psh. In addition to compromising IP cameras,...

CVE-2021-41277_SSRF

CVE-2021-41277SSRF CVE-2021-41277 can be extended to an SSRF Description Metabase is an open source data analytics platform. Metabase versions 0.40.5 were affected by CVE-2021-41277 which led to local file inclusion according to the CVE description. While analyzing the finding described in Metaba...

CVE-2026-43284-CVE-2026-43500-scan

DirtyFrag Scanner & Patcher Internal Network Tool for CVE-2026-43284 & CVE-2026-43500 Automated Linux LPE Audit & Mitigation via SSH Disclaimer : This tool is specifically designed for legitimate internal security audits. Using it without authorization against systems that are not yours is a...

cve-2023-27163

Thank you to @beet1ehttps://github.com/b33t1e from Shanghai Jiao Tong University and @chenlibo147 , @houqinsheng, [email protected] from Shandong University. Please review https://notes.sjtu.edu.cn/s/MUUhEymt7 for indepth information about the SSRF vulnerability CVE-2023-27163. This code is...

internal-penetration-testing-project-using-Metasploit

This repository does not have a README...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...