143 matches found
Directus GraphQL Field Duplication Denial of Service (DoS)
Summary A denial of service DoS attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and...
Gibbon LMS 26.0.00 PHP Deserialization / Code Execution
Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version Date: 22.01.2024 Exploit Author: SecondX.io Research TeamAli Maharramli,Fikrat Guliev,Islam Rzayev Vendor Homepage: https://gibbonedu.org/ Software Link: https://github.com/GibbonEdu/core Version: v26.0.00...
Aladdin - Payload Generation Technique That Allows The Deseriallization Of A .NET Payload And Execution In Memory
Aladdin is a payload generation technique based on the work of James Forshaw @tiraniddo that allows the deseriallization of a .NET payload and execution in memory. The original vector was documented on https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html. By spawning the...
HardHatC2 - A C# Command And Control Framework
A cross-platform, collaborative, Command & Control framework written in C, designed for red teaming and ease of use. HardHat is a multiplayer C .NET-based command and control framework. Designed to aid in red team engagements and penetration testing. HardHat aims to improve the quality of life...
Exploit for Code Injection in Apache Commons_Text
Text4ShellPayloads - This project includes a python script...
Exploit for Code Injection in Exiftool_Project Exiftool
Exploit for CVE-2021-22204 ExifTool - Arbitrary Code Executi...
NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit
ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because of this, I started on a full rewrite of NimPackt, dubbed...
Exploit for CVE-2022-26318
watchguardcve-2022-26318 Watchguard RCE POC CVE-2022-26318...
SillyRAT - A Cross Platform Multifunctional (Windows/Linux/Mac) RAT
A Cross Platform multifunctional Windows/Linux/Mac RAT. Getting Started Description A cross platform RAT written in pure Python. The RAT accept commands alongside arguments to either perform as the server who accepts connections or to perform as the client/target who establish connections to the...
Gopherus
This is a Python script for a tool called Gopherus, which is used to exploit Server-Side Request Forgery SSRF vulnerabilities in various services. The tool can generate payloads for different services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a...
marshalsec
This is a Java-based tool for exploiting Java object deserialization vulnerabilities, specifically targeting BlazeDS AMF Action Message Format versions 0, 3, and X. The tool, named "marshalsec," is designed to test and demonstrate the exploitation of these vulnerabilities, which can lead to remot...
Exploit for CVE-2017-0143
MS17-010 🖥️ -h3x0v3rl0rd- ️⃣ CVE-2017-0143 Docker Usin...
Exploit for CVE-2017-0143
MS17-010 🖥️ -h3x0v3rl0rd- ️⃣ CVE-2017-0143 Docker Usin...
Exploit for CVE-2017-0143
MS17-010 🖥️ -h3x0v3rl0rd- ️⃣ CVE-2017-0143 Docker Usin...
Exploit for CVE-2017-0143
MS17-010 🖥️ -h3x0v3rl0rd- ️⃣ CVE-2017-0143 Docker Usin...
Exploit for CVE-2017-0143
MS17-010 🖥️ -h3x0v3rl0rd- ️⃣ CVE-2017-0143 Docker Usin...
marshalsec
This is a Java-based tool for exploiting Java object deserialization vulnerabilities, specifically targeting various Java open-source marshalling libraries. The tool, named "marshalsec," is designed to unmarshal arbitrary, attacker-supplied types and demonstrate the potential for remote code...
Notepad notes 2.6.7 - Denial of Service (PoC)
Exploit Title: Notepad notes 2.6.7 - Denial of Service PoC Date: 2021-06-02 Author: Brian Rodríguez Download Link: https://play.google.com/store/apps/details?id=com.hlcsdev.x.notepad&hl=esMX Version: 2.6.7 Category: DoS Android Vulnerability Bloc de notas is vulnerable to a DoS condition when a...
PwnLnX - An Advanced Multi-Threaded, Multi-Client Python Reverse Shell For Hacking Linux Systems
An advanced multi-threaded , multi-client python reverse shell for hacking linux systems. There's still more work to do so feel free to help out with the development. Disclaimer : This reverse shell should only be used in the lawful, remote administration of authorized systems. Accessing a comput...
ysoserial
This is a Java tool called ysoserial, which generates payloads that exploit unsafe Java object deserialization. The tool is designed to create gadgets that can be used to execute arbitrary code on a Java application that performs unsafe deserialization. The tool takes a user-specified command and...