[SpearPhisher] A Simple Phishing Email Generation Tool

SpearPhisher is a simple point and click Windows GUI tool designed for mostly non-technical people who would like to supplement the education and awareness aspect of their information security program. Not only is it useful to non-technical folks, penetration testers may find it handy for sending...

eM Client e-mail client 5.0.18025.0 - Persistent Cross-Site Scripting

eM Client e-mail client 5.0.18025.0 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/...

eM Client 5.0.18025.0 Cross Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Date: 22-08-2013 Product: eM Client for Windows Version: 5.0.18025.0 previous versions and other platforms may be vulnerable Vendor Site: http://www.emclient.com/ Software Download: http://www.emclient.com/download Tested on: Windows X...

[CookieCatcher] Session Hijacking Tool

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

dreamMail e-mail client v4.6.9.2 Stored XSS Vulnerability

Exploit for windows platform in category remote exploits !/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3...

dreamMail e-mail client 4.6.9.2 - Persistent Cross-Site Scripting

dreamMail e-mail client 4.6.9.2 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Window...

dreamMail e-mail client 4.6.9.2 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: dreamMail e-mail client Version: 4.6.9.2 Vendor Site: http://www.dreammail.eu Software Download: http://www.dreammail.eu/intl/en/download.html Tested on: Windows XP SP3 Eng. Tested on: Windows 7 Pro SP1 Eng. dreamMail: Using...

[Xenotix XSS Exploit Framework v4] Advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting XSS vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine Trident, WebKit, and Gecko embedded scanner. It is claimed to have the world’s 2nd...

Vulnerability in USB Internet Modems allows hacker to access Millions of Computers remotely

A USB Internet Modems or Data card, is a type of modem that allows your computer to receive Internet access using USB Port and connect to a GSM/CDMA network there by creating a PPPoE Point to Point protocol over Ethernet interface to your computer. Indian Security Researcher 'Rahul Sasi' found a...

[Nishang v0.3.0] The PowerShell for Penetration Testing released (introducing Powerpreter)

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests. Powerpreter is a powershell module...

[Drozer] The Leading Security Testing Framework for Android.

drozer enables you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps’ IPC endpoints and the underlying OS. drozer provides tools to help you use and share public Android exploits. It helps you to deploy a droze...

Debian DSA-2715-1 : puppet - code execution

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially crafted payload to execute arbitrary code on the puppet master. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Debian Security Advisory DSA 2715-1 (puppet - code execution)

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master. OpenVAS Vulnerability Test $Id: deb2715.nasl 6611 2017-07-07 12:07:20Z...

Ubuntu Update for puppet USN-1886-1

Check for the Version of puppet OpenVAS Vulnerability Test $Id: gbubuntuUSN18861.nasl 7958 2017-12-01 06:47:47Z santu $ Ubuntu Update for puppet USN-1886-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...

Ubuntu: Security Advisory (USN-1886-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1886-1: Puppet vulnerability

It was discovered that Puppet incorrectly handled YAML payloads. An attacker on an untrusted client could use this issue to execute arbitrary code on the primary server...

New Autorun Malware Spiking

Autorun malware used to be kind of a big deal around here. Worms that jump directly from removable media such as USB drives as soon as they are connected to a PC can cause some major trouble, spreading quickly through a network. Microsoft made a change to newer versions of Windows that disables t...

[Nishang v.0.2.7] PowerShell for Penetration Testing

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests.It contains many interesting script...

Linksys WRT160nv2 apply.cgi Remote Command Injection

Exploit for hardware platform in category remote exploits require 'msf/core' require 'rex/proto/tftp' class Metasploit3 'Linksys WRT160nv2 apply.cgi Remote Command Injection', 'Description' = %q Some Linksys Routers are vulnerable to an authenticated OS command injection on their web interface...

Linksys WRT160n apply.cgi Remote Command Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex/proto/tftp' class Metasploit3 'Linksys...