metasploitable-pentest-lab

Metasploitable 中的漏洞利用 在受控且隔离的环境中完成一次真实攻击的完整流程：实验室准备、nmap 侦察、攻击面优先级排序、CVE 映射、Metasploit 漏洞利用、后渗透、凭据提取与破解，以及通过 SSH 密钥注入实现持久化。 1. 环境准备 攻击方 ：Kali Linux——msfconsole、nmap、John the Ripper。 目标 ：Metasploitable 1——Ubuntu 8.04（2010 年），未打补丁，存在多个已知 CVE。 网络 ：host-only，两台 VM 与任何真实网络隔离（192.168.64.0/24）。受害机...

CVE-2025-68493

CVE-2025-68493 CVE-2025-68493 7. 参考資料 1 ApacheStrutsXWorkXML脆弱性CVE-2025-68493のPoCおよびスクリプト | ZONE.CI 全球网. https://zone.ci/secarticles/wx/486533.html 8. 脆弱性の検証と悪用 CVE-2025-68493 脆弱性を検証および悪用するには、以下の Python PoC スクリプトと Nuclei YAML テンプレートを使用できます。 8.1 Python PoC スクリプトの使用方法 スクリプト名 : cve202568493poc.py 機能...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

POC-CVE-2026-19295

Description Proof of concept exploit code for CVE-2026-19295 Usage python3 poc.py -url -uname -pword -c...

CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89243 WWBN AVideo Stored XSS via UserGroups setGroup_name

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

ghidra_stack_strings

Ghidra 堆栈字符串 一个用于检测由所选 x86/x64 指令生成的堆栈字符串（stack-strings）的脚本，并使用 Unicorn 进行模拟执行。 该脚本使用 Python 3 编写，因此需要 Ghidrathon。...

CVE-2026-83545

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

WordPress Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button plugin <= 3.5.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by uhcna - vietnam in WordPress Plugin Chaty versions = 3.5.9...

GodPotato-Aggressor-Script

GodPotato-Aggressor-Script GodPotato 由 BeichenDream 编写，可在 https://github.com/BeichenDream/GodPotato 找到。...

HttpStrike

HttpStrike 一个用 Python 编写的快速 DDoS 脚本，如果你增加请求数量，它会按照你的意愿发送大量 GET 请求。...

EUVD-2026-75967

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

EUVD-2026-75956

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

BIT-TOMCAT-2026-50229 Apache Tomcat: XSS in number guess example

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0...

msiscan

MSI Analyzer Este script de Python para Linux puede analizar archivos instaladores de Microsoft Windows .msi y señalar posibles vulnerabilidades. Fue desarrollado por Michael Baer @derbaer0 en el SEC Consult Vulnerability Lab. Actualmente, está orientado principalmente a una escalada local de...

postgres-bruteforcer

postgres-bruteforcer 关于 这个 Go 脚本从名为 creds.txt 的文件中读取用户名和密码列表，并针对 PostgreSQL 数据库进行测试。 该脚本接受 PostgreSQL 服务器的 IP 作为命令行参数，或接受包含 IP 的文本文件。 如果访问被授予，脚本会将此输出写入名为 pg-output.txt 的文件中。 如果 postgres 用户可用，这通常是一个超级用户，可以允许 RCE、LFI 或 SSRF。 如何安装 root@kitploit: go install -v...

grafana-bruteforce

grafana-bruteforce 一个使用组合用户名和密码列表来尝试暴力破解 Grafana 登录页面的工具。 Grafana 会在 5 次尝试后将你锁定，因此你需要确保你的代理具有多个外部 IP 地址。 如何运行 使用自带的组合列表 root@kitploit: python3 grafana-brute.py -u http://localhost:3000 使用你自己的组合列表。 root@kitploit: python3 grafana-brute.py -u http://localhost:3000 -f mycombo.txt 示例...

bucket-brute

bucket-brute Aws S3 Tko 工具 root@kitploit: usage: bucket-brute.py -h -u URL -p PROXY -b BUCKET optional arguments: -h, --help show this help message and exit -u URL, --url URL No Such Bucket URL -p PROXY, --proxy PROXY Proxy for debugging -b BUCKET, --bucket BUCKET Bucket Name 示例 root@kitploit:...

magnolia-rce

漏洞标题：Magnolia DX Core 6.3.8 - 命令注入 日期：05/16/2025 漏洞作者：tmrswrr 版本：6.3.8 厂商主页：https://docs.magnolia-cms.com/home/ 产品：https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. 以管理员身份进行身份验证： https://demoauthor.magnolia-cms.com/.magnolia/admincentral Username:...