mad-metasploit

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection https://www.hahwul.com/p/mad-metasploit.html Awesome open awesome.md Add mad-metasploit to metasploit framework 1. config your metasploit-framework directory $ vim config/config.rb $metasploitpath =...

SpringBoot_Actuator_RCE

Интерфейс swagger-ui /swagger-ui.html SpringBoot env: получение конфиденциальной информации часть 1 Когда мы напрямую обращаемся к сайту springboot, видно, что некоторые поля password заполнены звёздочками 1. С помощью $name можно получить поле в открытом виде 2. Неправильная конфигурация приводи...

Adobe: Disclosure of git metadata and springboot actuator information

The vulnerability involved the disclosure of git metadata and Springboot actuator information, which was responsibly disclosed and addressed through collaboration with the hacker...

U.S. Dept Of Defense: springboot actuator is leaking internals at ██████████

Proof of Concept If you go to https://█████████/actuator you'll get a complete overview of all the endpoints that are accessable Suggestion: Use a Firefox Browser if possible, its json representation is well formed and the links are clickable ██████████ Impact Information Disclosure...