padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

cliam

cliam Multi cloud iam permissions enumeration tool. Currently covers: AWS GCP Azure Oracle 🚧 WIP Description Cliam is a simple cloud permissions identifier. There are two main components to the CLI. Most of the enumerated permissions are list, describe or get permissions. enumerate which can be...

vuls

Vuls: VULnerability Scanner Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. Twitter: @vulsen Abstract For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in a production...

PadBuster

PadBuster - Automated script for performing Padding Oracle attacks Author: Brian Holyfield - Gotham Digital Science [email protected] Credits to J.Rizzo and T.Duong for providing proof of concept web exploit techniques and S.Vaudenay for initial discovery of the attack. Credits also to James...

rbndr

rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...

ghauri

Like Ghauri, consider supporting the developer...

cve-2023-21987-poc

cve-2023-21987-poc Vulnerabilidad de lectura fuera de los límites OOB-Read en VGA de Oracle VirtualBox Este Prueba de Concepto PoC está diseñado para un sistema operativo invitado Linux que se ejecuta en un sistema operativo anfitrión Windows. El propósito de este PoC es demostrar la capacidad de...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

CVE-2020-14882

CVE-2020-14882 Este script de Python está diseñado para explotar una vulnerabilidad de Ejecución Remota de Código en Oracle WebLogic Server CVE-2020-14882 para ejecutar comandos en un servidor objetivo vulnerable y capturar su salida a través de peticiones HTTP. Primero solicita la URL de WebLogi...

padding-oracle-attacker

padding-oracle-attacker CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI. Install Make sure Node.js is installed, then run root@kitploit: $ npm install --global padding-oracle-attacker or root@kitploit: $ yarn global add...

cve-2019-9053-py3

CVE-2019-9053 — CMS Made Simple SQLi Exploit Python 3 Disclaimer: This tool is intended for authorized penetration testing and educational purposes only. Running this against systems without explicit written permission is illegal. The author assumes no liability for misuse. Overview This is a...

ESAPI-SQLinjection-CVE-2025-5878-Exploit

Componentes afectados: el método ESAPI.encoder.encodeForSQL y la clase OracleCodec Versiones afectadas: 2.2.0.0-2.6.2.0 Uso: similar a sqlmap usage: esapi-sqlinjection.py -h -u URL -c COOKIE --dbs --tables --columns -D DB -T TABLE -C COLUMN --dump esapi-sqlinjection.py: error: the following...

CVE-2018-2636

Instalación root@kitploit: $ pip install --user requests argparse unicodedata Información PoC para CVE-2018-2636. Ejemplo de uso root@kitploit: python eGw.py -H 127.0.0.1 -P 8080 -i ... Let's get info about server ! Your instance is vulnerable to CVE-2018-2636 ... Enlaces Oracle Critical Patch...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Framework-Toolkit de Explotación de Omisión de Autenticación SAML de Oracle WebLogic Oracle WebLogic Server — Omisión de Autenticación SAML → Toma de Control de Administrador Framework de Explotación y Escáner Masivo Solo para pruebas de seguridad autorizadas. ⚖️ Aviso Legal y Uso...

CVE-2017-10271

Identificación y explotación de CVE-2017-10271. RCE no autenticado en Weblogic. https://nvd.nist.gov/vuln/detail/CVE-2017-10271 https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html root@kitploit: POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: SOMEHOSTHERE Content-Length:...

CVE-2025-61882-POC

CVE-2025-61882 Security Testing Tool 🚨 CRITICAL LEGAL WARNING See our blog post for technical details THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ ║ ║ 🚨 UNAUTHORIZED ACCESS TO COMPUTER SYSTEMS IS ILLEGAL 🚨 ║ ║ ...

CVE-2017-10366_peoplesoft

CVE-2017-10366: Exploit de deserialización Java de Oracle PeopleSoft 8.54, 8.55, 8.56 Este script automatiza la explotación de una vulnerabilidad de deserialización Java en Oracle PeopleSoft, descubierta originalmente por Vahagn Vardanyan. Este exploit requiere ysoserial.jar para generar payloads...

CVE-2021-2173

CVE-2021-2173 CVE-2021-2173 PoC is explained here: https://databasesecurityninja.wordpress.com/2021/06/04/cve-2021-2173-pdb-isolation-is-broken-through-metadata-exposure/ Oracle Critical Patch Update Advisory - April 2021: https://www.oracle.com/security-alerts/cpuapr2021.html...

CVE-2022-27434

CVE-2022-27434 Se descubrió que UNIT4 TETA Mobile Edition 29HF13 contiene una vulnerabilidad de inyección SQL a través del parámetro ProfileName en la página errorReporting. La vulnerabilidad existe en la página de error generada por la aplicación en este caso: al cambiar la contraseña. Agregar u...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...