CVE-2024-21733

CVE-2024-21733-POC Notes: 1. tomcat English environment 2. Specific constructed backend code, as shown in ROOT/vulnerable.jsp 3. If needed, modify the server address and port in the script. Default 127.0.0.1:8080 4. Timeout trigger, default 20 seconds, usually less than this time Process: 1...

Incident-Response-Report-TeamCity-Compromise-CVE-2024-27198-

Incident Response Report: TeamCity Compromise CVE-2024-27198 Analyst: Belal Abdelsalam Date: July 2026 Lab/Environment: CyberDefenders JetBrains 📄 Executive Summary This report documents the forensic analysis of a compromised JetBrains TeamCity server version 2023.11.3. By analyzing the provided...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

Shiro_Xray

ShiroXray Gadget CommonsBeanutils1 CommonsCollectionsK1 CommonsCollectionsK2 Getshell with Ice Scorpion import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import java.io.PrintWriter; import java.net.URLDecoder; import sun.misc.BASE64Decoder; public class 10837093162496 exten...

tomcatWarDeployer

tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool. What is it? This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell...

CVE-2024-50379

Manual exploitation is troublesome, so I whipped up an exp.. Usage: shell.jsp is the shell file, ggsl.jsp is the name/path saved to the target server. ./CVE-2024-50379 -u http://192.168.2.245:8080 -f shell.jsp -p ggsl.jsp Disclaimer This tool is only intended for legally authorized enterprise...

wsh

wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...

CVE-2017-14105

Aerohive HiveManager Classic Privilege Escalation Vulnerability Name Aerohive HiveManager Classic Privilege Escalation Vulnerability Systems Affected HiveManager Classic 8.0r1 8.1r1 Severity Medium 6.6/10 Impact CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:H/RC:C Vendor http://www.aerohive.com/...

spring4shell-exploit-poc

Spring4Shell Exploit POC Exploit a Spring Application vulnerable to the Spring4Shell vulnerability. Read more about Spring4shell on our blog. Usage Requirements: Docker and docker-compose $ ./exploit.sh Vulnerable Spring Application The vulnerable Spring application contains a GET and POST reques...

jboss-autopwn

jboss-autopwn JBoss Autopwn as featured at BlackHat Europe 2010 - this version incorporates CVE-2010-0738 the JBoss authentication bypass VERB manipulation vulnerability as discovered by Minded Security C. Papathanasiou 2010 INTRODUCTION This JBoss script deploys a JSP shell on the target JBoss A...

webshell-analyzer

Web Shell Analyzer Web shell analyzer is a cross platform stand-alone binary built solely for the purpose of identifying, decoding, and tagging files that are suspected to be web shells. The web shell analyzer is the bigger brother to the web shell scanner project...

CVE-2026-63077

Unauthenticated Remote Code Execution in JetBrains TeamCity CVE-2026-63077 Overview This is a proof-of-concept exploit script for CVE-2026-63077. Organizations can use this script to validate their detection and remediation posture. For a full technical analysis of CVE-2026-63077, please read our...

CVE-2022-30929

CVE-2022-30929 CVE-2022-30929 POC Suggested description Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. Vulnerability Type Insecure Permissions Vendor of Product github;gitee Affected Product Code Base...

NebulaPulsar

NebulaPulsar Update: This project has now become a sub-project of Alien for demonstrating my ideas and experimental purposes. NebulaPulsar is a proof-of-concept in-memory implant framework for Java JSP and ASP.NET ASPX/ASHX/ASMX, originally developed as part of the Alien project. Unlike tradition...

CVE-2025-31324

SAP CVE-2025-31324 Analyzer A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of Compromise IOCs such as malicious .jsp. 🚀 Features Detects vulnerable Visual Composer endpoints Scans for known malicious...

wso2-rce-cve-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading...

ghostcat

This tool exploits an LFI vulnerability within Apache Tomcat named CVE-2020-1938 to not only view sensitive files, but also to run malicious JSP payloads. It can be downloaded here you will need to run it from the command line Usage: ghostcat target HTTP port AJP port file read/eval...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...

CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

Spring4Shell

Spring RCE CVE-2022-22965 Vulnerability Environment Environment Information springboot jdk11 tomcat9.0.30 payload Request Header Configuration "suffix": "%//", "c1": "Runtime", "c2": "%", "DNT": "1", "Content-Type": "application/x-www-form-urlencoded", Request Body Data...