Test your barcode scanners: MalQR

Test your barcode scanners MalQR is a collection of malicious QR codes and barcodes you can use to test the security of your scanners. It gives you the ability to conduct such tests with easiness : you just need to have a smartphone, a tablet or a laptop with an internet connection and browse...

WordPress Exploit Framework

WordPress Exploit Framework is a Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems. Requirements Ensure that you have Ruby 2.2.x installed on your system and then install all required dependencies by opening a command...

at(1) Persistence

This module achieves persistence by executing payloads via at1. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'at1 Persistence', 'Description' = %q This module achieves persistence by executin...

U.S. Dept Of Defense: Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████

Details: There is currently a security misconfiguration on plain.php function located on the host http://██████████/ allowing attackers to include webserver contents of their choosing no restriction on filetypes and/or IP addresses, as well as embed malicious javascript payloads in the response v...

Cyber Attack Knocks Nearly a Million Routers Offline

Mirai Botnet is getting stronger and more notorious each day that passes by. The reason: Insecure Internet-of-things Devices. Last month, the Mirai botnet knocked the entire Internet offline for a few hours, crippling some of the world's biggest and most popular websites. Now, more than 900,000...

Human Interface Device Exploit Deployment: Brutal

Human Interface Device Exploit Deployment Brutal is a toolkit to quickly create various payload,powershell attack , virus attack and launch listener for a Human Interface Device Payload Teensy . Extremely useful for executing scripts on a target machine without the need for human-to-keyboard...

Dlink DIR Routers - Unauthenticated HNAP Login Stack Buffer Overflow (Metasploit) Exploit

Exploit for hardware platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' Payload working status: MIPS: - all valid payloads working the ones that we are able to send...

From XSS to RCE: XSSer

From XSS to RCE This demonstrates how an attacker can utilize XSS to execute arbitrary code on the web server when an administrative user inadvertently triggers a hidden XSS payload. Custom tools and payloads integrated with Metasploit’s Meterpreter in a highly automated approach will be...

MyBB 1.8.6 - Cross-Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 01/29/2016 Disclosed...

WAFNinja - Penetration testers favorite for WAF Bypassing

WAFNinja is a CLI tool written in Python. It shall help penetration testers to bypass a WAF by automating steps necessary for bypassing input validation. The tool was created with the objective to be easily extendible, simple to use and usable in a team environment. Many payloads and fuzzing...

Brave Software: [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html

go to https://brave.com/braveyouthprogramsignup.html click become an ambasador insert malicious payloads in the fields YOU JUST WON 1m$ you will receive a mail like in the image attached. You can send phising emails and do other bad stuff. If you need more details i'm here...

CodeIgniter: Link sanitation bypass in xss_clean()

Hi there, While researching a website that uses your framework xssclean function to sanitize user's input in comments, I was able to bypass it and could trigger XSS payloads using javascript links in allowed tags such as anchors. This could be achieved by using the new HTML5 standard entities suc...

Trend Micro Control Manager 6.x < 6.0 SP3 Hotfix 3328 Multiple Vulnerabilities

According to its version, the Trend Micro Control Manager application installed on the remote Windows host is 6.x prior to 6.0 SP 3 Hotfix 3328 6.0.0.3328. It is, therefore, affected by the following vulnerabilities : - A directory traversal vulnerability exists in the taskcontroller.php script d...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)

Note::steps mentioned in report164027 In the Comments Box,the payload to execute XSS is passed. Test Payloads: alert1 Also the above payload is still working.. Also try this payload " fooalert1 Click edit comment after posted. XSS Triggers...

libenom - Make Fast and Easy Payloads with MSFvenom

Libenom is a tool created for make more easy and fast the creation of payloads with MSFvenom and get all the data generated ordered. Requirements A linux distribution for pentesting or Ubuntu, Debian, Mint Recommended Kali Linux 2.0 sana or 2016.1 rolling, Parrot OS, Blackarch, Dracos ,Lionsec...

Nextcloud: Reflected Self-XSS Vulnerability in the Comment section of Files Information

Vulnerability Found In the test domain: demo.nextcloud.com Vulnerability Type : Reflected XSS STEPS TO REPRODUCE: STEP 1: Login to demo nextcloud server site using test credentials.demo.nextcloud.com STEP 2: On the All Files Tab ,Select Any File. STEP 3: A tab opens on the Right Hand side of the...

Universal Serial aBUSe: USaBUSe

Universal Serial aBUSe Universal Serial aBUSe is a project released at Defcon 24 by Rogan Dawes. The team took some fairly common attacks fake keyboards in small USB devices that type nasty things and extended them to provide us with a bi-directional binary channel over our own wifi network to gi...

SMB Delivery Module

require 'msf/core' require 'msf/core/exploit/powershell' class MetasploitModule "SMB Delivery", 'Description' = %q This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell. , 'License' = MSFLICENSE,...

SMB Delivery

This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell. Module Options msf use exploit/windows/smb/smb/delivery msf undefineddelivery show actions ...actions... msf undefineddelivery set ACTION msf...

Magnitude Exploit Kit Redirection

Magnitude exploit kit is a web exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users with Magnitude exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code...