1558 matches found
Zeebsploit - Web Scanner / Exploitation / Information Gathering
zeebsploit is a tool for hacking searching for web information and scanning vulnerabilities of a web Installation & Usage apt-get install git git clone https://github.com/jaxBCD/Zeebsploit.git cd Zeebsploit chmod +x install ./install python3 zeebsploit.py type 'help' for show modules and follow...
X (Formerly Twitter): Subdomain takeover on dev-admin.periscope.tv
Subdomain takeover on dev-admin.periscope.tv I takeover the subdomain and upload the index file : index.html Impact Subdomain takeover on dev-admin.periscope.tv Subdomain takeover on dev-admin.periscope.tv/index.html http://dev-admin.periscope.tv.s3-website-us-west-2.amazonaws.com/index.html...
CVE-2019-10884
Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and crea...
Darksplitz - Exploit Framework
This tools is continued from Nefix, DirsPy and Xmasspy project. Installation Will work fine in the debian shade operating system, like Backbox, Ubuntu or Kali linux. 1. $ git clone https://github.com/koboi137/darksplitz 2. $ cd darksplitz/ 3. $ sudo ./install.sh Features Extract mikrotik credenti...
Mail.ru: Phpinfo
phpinfo was available at terrhq.ru subdomain...
Osmedeus - Fully Automated Offensive Security Tool For Reconnaissance And Vulnerability Scanning
Osmedeus allow you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target. How to use If you have no idea what are you doing just type the command below or check out the Advance Usage ./osmedeus.py -t example.com Installation git clone...
UBUNTU-CVE-2019-10648
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction DNS, as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL...
Mail.ru: Открытые сорцы
gitlab repository with opensource projects was available from external network on geekbrains.ru subdomain. While no sensitive information was leaked, decision was made to limit the access to eliminate possible risks in future...
Chomp Scan - A Scripted Pipeline Of Tools To Streamline The Bug Bounty/Penetration Test Reconnaissance Phase
A scripted pipeline of tools to simplify the bug bounty/penetration test reconnaissance phase, so you can focus on chomping bugs. Scope Chomp Scan is a Bash script that chains together the fastest and most effective tools in my opinion/experience for doing the long and sometimes tedious process o...
VK.com: [0.vk.com] Reflected XSS на странице подтверждения.
XSS в старых версиях IE на мобильной версии сайта, доступной некоторым операторам. Reflected XSS на поддомене 0.vk.com. only IE\MTS\Beeline...
Ford: Subdomain takeover on usclsapipma.cv.ford.com
Hello Ford H1 team, I want to report a Subdomain takeover vulnerability in this report, a pretty serious security issue in some context. Overview: One of the ford.com subdomains is pointing to Azure, which has unclaimed CNAME record. ANYONE is able to own ford.com subdomain at the moment. This...
ALPINE-CVE-2018-5741
To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...
DEBIAN-CVE-2018-5741
To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...
UBUNTU-CVE-2018-5741
To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...
Khan Academy: Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org
Summary : healthyhackathon.khanacademy.org can be took over, since it points to a bucket in S3 but that bucket does not exists. I know this domain is used to host information of healthyhackathon which is held by khanacademy, but you will not be able to do this anymore if someone is going to claim...
Python Cryptographic Authority: Reflected Xss bypass Content-Type: text/plain
Hello Team: -------------- 1 - vulnerable subdomain : ci.cryptography.io 2 - after i tested this subdomain i found many payloads injected by me reflected but not executed 3 - so that i taked alook at the response and i found Content-Type: text/plain 4 - so i searched about bypass Content-Type:...
Knock v.4.1.1 - Subdomain Scan
Knockpy is a python tool designed to enumerate subdomains on a target domain through a wordlist. It is designed to scan for DNS zone transfer and to try to bypass the wildcard DNS record automatically if it is enabled. Now knockpy supports queries to VirusTotal subdomains, you can setting the...
Mail.ru: sql
SQL interface for web analytics was available at terrhq.ru subdomain...