minipwner

MiniPwner A script to configure a TP-Link MR3040 running OpenWRT into a simple, yet powerful penetration-testing "drop box". What is the "MiniPwner"? The MiniPwner is a penetration testing "drop box". It is designed as a small, simple but powerful device that can be inconspicuously plugged into a...

packetfence

PacketFence What is PacketFence? PacketFence is a fully supported, trusted, Free and Open Source network access control NAC system. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2...

sshuttle

sshuttle: where transparent proxy meets VPN meets ssh As far as I know, sshuttle is the only program that solves the following common case: Your client machine or router is Linux, FreeBSD, MacOS or Windows. You have access to a remote network via ssh. You don't necessarily have admin access on th...

fcn-

fcn free connect your private network from anywhere 1. What is fcn fcnfree connect is a foolproof one-click tool for accessing private networks, consisting of the server side and the client side fcn uses fcn public data servers and data encryption technology to virtually connect user clients to...

PXEThief

PXEThief PXEThief is a set of tooling that implements attack paths discussed at the DEF CON 30 talk Pulling Passwords out of Configuration Manager https://forum.defcon.org/node/241925 against the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager or ConfigMgr,...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

sshuttle

sshuttle: where transparent proxy meets VPN meets ssh As far as I know, sshuttle is the only program that solves the following common case: Your client machine or router is Linux, FreeBSD, or MacOS. You have access to a remote network via ssh. You don't necessarily have admin access on the remote...

CVE-2023-27163

Proof Of Concept of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and...

singularity

Singularity of Origin Mises à jour récentes : NOUVEAU 2025-11-25 : Chrome version 142 a ajouté l'Accès au Réseau Local LNA, qui empêche les techniques d'attaque par rebinding DNS implémentées dans Singularity. La branche LNA-from-Non-Secure-Contexts de Singularity of Origin implémente le support ...

BloodHound-Tools

What is this? A collection of tools that integrate to BloodHound. Bloodhound is the defacto standard that both blue and red security teams use to find lateral movement and privilege escalation paths that can potentially be exploited inside an enterprise environment. A typical environment can yiel...

CVE-2024-47533-Cobbler-XMLRPC-Authentication-Bypass-RCE-Exploit-POC

CVE-2024-47533 - Cobbler XMLRPC Authentication Bypass RCE Exploit ⚠️ Critical Remote Code Execution via Authentication Bypass in Cobbler 🛠️ PoC implementation by @dollarboysushil 💡 Overview Cobbler, a Linux installation server that enables rapid setup of network installation environments, has an...

WonderShell

WonderShell - CVE - 2021-44595 | CVE - 2021-44596 Discovered by Netanel Cohen and Tomer Peled a Security Researchers from BugSec. Description POC example to exploit Wondershare Dr.Fone . Dr.Fone is a phone toolkit develop by wondershare , and vulnerable to RCE. Only with network access we manage ...

sshuttle

sshuttle : où le proxy transparent rencontre le VPN et ssh Pour autant que je sache, sshuttle est le seul programme qui résout le cas courant suivant : Votre machine cliente ou routeur est sous Linux, FreeBSD, MacOS ou Windows. Vous avez accès à un réseau distant via ssh. Vous n'avez pas...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

Gradio - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...

Memos 0.13.2 - Server-Side Request Forgery

SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

LocalAI - Partial Local File Read

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...