WS-Attacker

WS-Attacker WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum https://nds.rub.de/ and the Hackmanit GmbH https://hackmanit.de/. The basic idea behind WS-Attacker is to provide a functionality ...

CVE-2022-45047

CVE-2022-45047 POC,EXP,chatGPT为我生成 代码 root@kitploit: import requests targeturl = "http://127.0.0.1:7001" CVE-2022-45047 def exploitweblogic: headers = "Content-Type": "text/xml", "User-Agent": "Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:93.0 Gecko/20100101 Firefox/93.0", "Accept-Encoding": "gzip...

api-scanner-docker

API Scanner - 自托管部署 API Scanner 是一款自动化 API 安全测试工具，可利用 OpenAPI/Swagger 规范及 WSDL 文件扫描 REST 和 SOAP API 中的漏洞。 前提条件 Docker Engine 20.10+ Docker Compose v2 Python 3.6+（用于设置脚本） 最低 8 GB RAM（推荐 16 GB） 20 GB 磁盘空间 快速开始 1. 克隆本仓库 root@kitploit: git clone https://github.com/CSPF-Founder/api-scanner-docker.git ...

CVE-2025-59287-PoC

CVE-2025-59287 / CVE-2023-35317 PoC Dentro de CVE-2025-59287: SoapFormatter RCE en WSUS: https://shellcode.blog/wsus-cve-2025-59287-investigation/ Este software ha sido creado únicamente con fines de investigación académica y para el desarrollo de técnicas defensivas efectivas, y no está destinad...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198是思科IOS XE软件Web UI功能中的一个严重漏洞，允许未经身份验证的远程攻击者在受影响的系统上创建具有特权级别15的账户，从而完全控制设备。 该漏洞的产生主要源于Web UI功能中路径解析的不当处理。攻击者通过精心构造的HTTP请求，利用双重URL编码绕过Nginx的路径过滤机制，直接访问受保护的内部端点，如/webuiwsmahttp。通过这些端点，攻击者可以发送特制的SOAP请求，执行任意CLI命令或进行配置更改。...

Go365

Go365 v2.0 修复了AWS网关问题（感谢h0useh3ad！） 当代理服务器连接失败时不再崩溃 新增了图形端点 在使用Go365之前，请通读本README！ Go365是一款用于对使用Office365（现/即将更名为Microsoft365）的组织执行用户枚举和密码猜测攻击的工具。Go365使用了一个位于login.microsoftonline.com上的独特SOAP API端点，大多数其他工具不使用该端点。当使用电子邮件地址和密码进行查询时，该端点会返回一个Azure AD身份验证和授权码。Go365会处理该代码，并将结果显示在屏幕上或输出到文件中。...

CVE-2024-28752

Apache CXF CVE-2024-28752 复现环境 漏洞公告：https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt 环境启动 samples/javafirstjaxwsfactorybean IDEA 通过 ServerStarter.java 启动 webservice 服务 构建 使用 JDK8 root@kitploit: mvn clean package java -jar target/cxf.jar 漏洞利用 使用 BurpSuite 发送如下请求即可触发。 root@kitploi...

CNVD-C-2019-48814-CNNVD-201904-961

CNVD-C-2019-48814和CNNVD-201904-961 感谢t00ls-ximcx0101提供脚本 CNVD-C-2019-48814 POC Summary 相关链接如下: 清水川崎大佬的简书: https://www.jianshu.com/p/c4982a845f55 安全祖师爷转发: https://dwz.cn/2GQvbUae 由于环境的一些因素路径会存在变化: 默认上传路径为: servers/AdminServer/tmp/WLinternal/beawls9asyncresponse/8tpkys/war/...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Una vulnerabilidad de extracción de datos no autenticada en impresoras Kyocera, que permite recuperar la libreta de direcciones en texto claro y las contraseñas de dominio. Resumen de la vulnerabilidad A finales de 2021, durante una prueba de penetración, estaba experimentan...

CVE-2017-10271

CVE-2017-10271 识别与利用。未经认证的 WebLogic 远程代码执行。 https://nvd.nist.gov/vuln/detail/CVE-2017-10271 https://www.oracle.com/technetwork/topics/security/cpuoct2017-3236626.html root@kitploit: POST /wls-wsat/CoordinatorPortType HTTP/1.1 Host: SOMEHOSTHERE Content-Length: 1226 content-type: text/xml...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

Apache OFBiz < 17.12.07 - Arbitrary Code Execution

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack id: CVE-2021-29200 info: name: Apache OFBiz 17.12.07 - Arbitrary Code Execution author: your3cho severity: critical description: | Apache OFBiz has unsafe deserialization prior to...

MantisBT < 2.28.1 - SOAP API Authentication Bypass

Mantis Bug Tracker 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. id:...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

N-able N-central - Authentication Bypass

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal-only APIs. id: CVE-2026-86207 info: name: N-able N-central - Authentication Bypass author: rapid7,DhiyaneshDk severity: critical description: | An authentication bypass in N-central 2026.3 HF 3 leads to...

CVE-2017-8759_-SOAP_WSDL

¿Qué es CVE-2017-8759? es una vulnerabilidad de ejecución remota de código en SOAP WDSL Existe una vulnerabilidad de ejecución remota de código cuando Microsoft .NET Framework procesa entrada no confiable. Un atacante que explotara con éxito esta vulnerabilidad en software que usa el framework .N...

omigod

CVE-2021-38647: Omigod Another exploit for Omigod written quick and dirty in Go. The exploit uses and is based on: the research by wiz: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure the SOAP payload by midoxnet: https://github.com/midoxnet/CVE-2021-38647 the Python Proof of...

CVE-2026-30849-PoC

CVE-2026-30849.ts — 用法 此 TypeScript 脚本通过 SOAP 对 MantisBT 执行检查与利用。 前置条件 Node.js 已安装 依赖已安装： root@kitploit: npm install 命令 root@kitploit: ts-node CVE-2026-30849.ts check --url ts-node CVE-2026-30849.ts exploit --url root@kitploit: npx ts-node .\CVE-2026-30849.ts check --url http://mantis.local npx...

CVE-2022-46364-Poc

Exploit CVE-2022-46364 Apache CXF SSRF mediante MTOM XOP:Include | CVSS 9.8 CRÍTICO Vulnerabilidad Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerable requerido -s, --ssrf-url - URL interna para exfiltrar requerido -d, --domain - Dominio objetivo por defecto: localhost --plain-soap -...

CVE-2026-46592

CVE-2026-46592 — Inyección en el encabezado operationName de camel-cxf Redirección de operación SOAP Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por tiempo de ejecución:...