CVE-2017-5638

CVE-2017-5638 Apache Struts 2.3.5 Example:...

CVE-2018-11776

Vulnerable docker container for CVE-2018-11776 docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result : http://:8080/struts2-showcase-2.3.14/666/help.action PoC - 2...

CVE-2023-50164-PoC

CVE-2023-50164 Apache Struts path traversal to RCE vulnerability - Proof of Concept This PoC has been made to test an RCE Remote Code Execution by exploiting the Apache Struts2 vulnerability. Build the image and run a container: $ DOCKERBUILDKIT=1 docker build . -t struts2-rce-poc && docker run...

CVE-2021-31805-POC

CVE-2021-31805-POC Vulnerability Information Apache Struts is a free, open-source MVC framework for creating elegant, modern Java web applications. It favors convention over configuration, can be extended using a plugin architecture, and ships with plugins that support REST, AJAX, and JSON...

-CVE-2017-9805

Vulnerability information Resources: https://vulners.com/cve/CVE-2017-9805 What is this? A python exploit script capable of executing remote commands into the shell of a system hosting a Struts2 vulnerable to S2-052. Usage ╭─root@blackshell / ╰─ python s2-052.py --target...

struts-pwn_CVE-2017-9805

struts-pwn - CVE-2017-9805 Exploit An exploit for Apache Struts CVE-2017-9805 Usage Check if the vulnerability exists against a single URL. python struts-pwn.py --url 'http://example.com/struts2-rest-showcase/orders/3' Check if the vulnerability exists against a list of URLs. python struts-pwn.py...

S2-057-CVE-2018-11776

S2-057-CVE-2018-11776 A simple exploit for Apache Struts RCE S2-057 CVE-2018-11776 IMPORTANT: Is provided only for educational or information purposes. Deploy test environment git clone https://github.com/vulhub/vulhub cd vulhub/struts2/s2-057 docker-compose up -d Usage exploit.py Example $ pytho...

Strutter

Strutter Proof of Concept for CVE-2018-11776, comes complete with the ability to search Shodan API for targets CVE-2018-11776 Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper actions...

cve-2017-5638

cve-2017-5638 cve-2017-5638 Vulnerable site sample This project aims to demonstrate the CVE-2017-5638 exploitation for educational purpose. For more informations, see https://cwiki.apache.org/confluence/display/WW/S2-045 Legal Disclaimer This project is made for educational and ethical testing...

ApacheStruts-CVE-2018-11776

Apache Struts CVE-2018-11776 Python PoC This is based on https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. The container build and instructions did not work as described in the README so this fork was created. The POC exploit used is from Rapid7. Shoutout: hook-s3c github.com/hook-s3c,...

cve-2017-5638

CVE-2017-5638 PoC Code in Python | DORK: ext:action Example PoC Code for CVE-2017-5638 | Apache Struts Exploit | DORK: ext:action USAGE: python struts.py https://victim.site dir The initial Python Script that was Posted didn't correctly format the Content-Type Header. I recoded the Content Type...

S2-062

S2-062 CVE-2021-31805/s2-062 Batch Scanning and Exploitation Please comply with laws and regulations; unauthorized attacks on website systems are prohibited. Usage Batch Scan Mode python3 CVE-2021-31805.py -m scan -f 123.txt Command Execution Mode python3 CVE-2021-31805.py -u...

cve-2017-9805.py

CVE-2017-9805.py 1. Better Exploit Code For CVE 2017 9805 apache struts 2. Should be mostly error proof Why Recode? Found that most of the exploit code online simply used string concatenation to insert user supplied commands and insert into an XML string. This isnt very reliable as XML requires...

apache-struts-cve-2017-9805

The Apache Struts web framework The Apache Struts web framework is a free open-source solution for creating Java web applications. Web applications differ from conventional websites in that web applications can create a dynamic response. Many websites deliver only static pages. A web application...

CVE-2017-5638

CVE-2017-5638 Table of Contents 1. Overview 2. Dependencies 3. Usage Overview This project is a prove-of-concept for the Apache Struts vulnerabilty. The goal was to create software that can generate and test random IPs for the vulnerabilty described above. Use this project on your own risk and fo...

CVE-2024-53677-Exploitation

CVE-2024-53677 Exploitation Apache Struts RCE via File Upload Description CVE-2024-53677 is a vulnerability which impacts Apache Struts from 2.0.0 before 6.4.0. ⚠️ This was exploited in a Hack The Box lab. File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2026-86218

CVE-2026-86218 CVE-2026-86218 - N-able N-central Struts BeanUtils Unauthenticated RCE | ---|--- CVE| CVE-2026-86218 CVSS| 10.0 Critical Affected| N-central on-premises 2026.3.1.14 including Hotfix 3 Fixed| 2026.3 Hotfix 4 build 2026.3.1.14 Disclosed| 2026-09-05 CWE| CWE-96 Static Code Injection...

CVE-2021-31805

CVE-2021-31805 PoC for CVE-2021-31805 Apache Struts2 This is the application used in the CVE-2021-31805 explanation article. Setup $ docker-compose build $ docker-compose up -d Verification Access http://localhost:8080/struts2-showcase-2.5.29/index.html and confirm that the Welcome page is...

struts_cve-2024-53677

Proof-of-Concept Setup test environment » git clone [email protected]:0xPThree/strutscve-2024-53677.git » cd strutscve-2024-53677 » sudo docker build --ulimit nofile=122880:122880 -m 3G -t struts-6.3.0.1 . » sudo docker run -p 8081:8080 --ulimit nofile=122880:122880 -m 3G --rm -it --name...