Advanced-SQL-Injection-Cheatsheet

MySQL Error based SQL Injection Cheatsheet This is probably the easiest vulnerability along the SQL Injection attack. An attacker can enumerate and dump the MySQL database by using the SQL error messages to his advantage. Detecting the vulnerability http://domain.com/index.php?id=1 Website loads...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

POC-CVE-2026-58048

CVE-2026-58048 CVSS 4.0: 9.4 Critical | CWE-89: SQL Injection | NVD Authenticated cPanel user → arbitrary SQL as MySQL root via database rename. cPanel improperly preserves the user's session sqlmode ANSIQUOTES when executing rename operations as root — a backtick in the database name breaks out ...

TeamPass

Teampass Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence Your secrets never leave your infrastructure. 🌐teampass.net · 📖Documentation · 💬Discussions · 🐳Docker Hub Contents About Who it's for Securit...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

MySQL-Remote-Root-Code-Execution

MySQL-Remote-Root-Code-Execution Usage python rcemysql.py -dbuser -dbpass -dbname -dbhost -mycnf...

ASST

ASST BETA OWASP ASST Automated Software Security Toolkit | A Novel Open Source Web Security Scanner. Note: AWSS is the older name of ASST Introduction Web applications have become an integral part of everyday life, but many of these applications are deployed with critical vulnerabilities that can...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

mysslstrip

mysslstrip mysslstrip is a Python-based proof of concept showing how to MITM MySQL traffic and strip SSL/TLS, as per CVE-2015-3152. Usage mysslstrip.py -h -p LISTENPORT -i LISTENINTERFACE dest Example Output root@duo1 python2.7 mysslstrip.py -p 3307 127.0.0.1:3306 2015-04-29 21:33:14+0000 - Log...

mysql-baseline

DevSec MySQL Baseline This Compliance Profile ensures, that all hardening projects keep the same quality. https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/mysqlhardening https://github.com/dev-sec/chef-mysql-hardening https://github.com/dev-sec/puppet-mysql-hardening...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

adminer_CVE-2021-43008

CVE-2021-43008 — Adminer Vulnerability Arbitrary file reading via a malicious MySQL server 1. What is Adminer? Adminer is a web tool PHP for easily administering MySQL, PostgreSQL, SQLite or SQL Server databases. It is commonly deployed as a lightweight alternative to phpMyAdmin. Affected...

ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

Adminer-CVE-2021-43008

Adminer CVE-2021-43008 PoC Proof-of-concept exploit for CVE-2021-43008 affecting Adminer. This vulnerability allows a malicious MySQL server to request arbitrary local files from the client machine when LOAD DATA LOCAL INFILE is enabled. The repository contains tools to reproduce the attack...

CVE-2023-22884-Airflow-SQLi

Apache Airflow SQL injection PoC CVE-2023-22884 PoC for CVE-2023-22884 is an Apache Airflow RCE vulnerability affecting versions prior to 2.4.0. The official report description says: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software...

tproxy

tproxy English | 简体中文 | 日本語 Why I wrote this tool When I develop backend services and write go-zero, I often need to monitor the network traffic. For example: 1. monitoring gRPC connections, when to connect and when to reconnect 2. monitoring MySQL connection pools, how many connections and figur...

CVE-2026-101777

A flaw was found in the MySQL security encryption component. A remote attacker with high privileges can exploit this vulnerability over network protocols to cause the service to hang or crash repeatedly, resulting in a complete Denial of Service DoS. Additionally, successful exploitation can allo...

CVE-2026-101756

A flaw was found in the Geographic Information System GIS component of MySQL. An authenticated remote attacker with high privileges can exploit this vulnerability over the network to cause a Denial of Service DoS. Successful exploitation causes the database server to hang or crash repeatedly,...

CVE-2026-101755

A flaw was found in MySQL client programs. An authenticated attacker with network access and low privileges could exploit this vulnerability across multiple protocols. A successful attack allows the threat actor to cause an application hang or repeated crash, resulting in a complete Denial of...

CVE-2026-101753

A flaw was found in the RAPID component of MySQL. A remote attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or repeatedly crash. Successful exploitation results in a complete Denial of Service DoS of affected database services. Mitigation...