7513 matches found
SAP /sap/bc/soap/rfc SOAP Service RFC_READ_TABLE Function Dump Data
This module makes use of the RFCREADTABLE Function to read data from tables using the /sap/bc/soap/rfc SOAP service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, or is a port o...
SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation
This module makes use of the BAPIUSERCREATE1 function, through the SOAP /sap/bc/soap/rfc service, for creating/modifying users on a SAP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspire...
SAP SOAP Service RFC_PING Login Brute Forcer
This module attempts to brute force SAP username and passwords through the /sap/bc/soap/rfc SOAP service, using RFCPING function. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, o...
LastClick Cross Site Scripting / SQL Injection
| | | | \ / | \ / | \ / \ \ / / | | | | | | | | | | | | | | | | | | \ V / | | | | /| | | | http://site.com/.vernota.php?id= Exploit/Comand/Sql= +union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--+ Exploit/Comand/Xss= " Payload/Comand/Sql= tableschema=0x73616C61646...
AustroSoft Cross Site Scripting / SQL Injection
| | | | \ / | \ / | \ / \ \ / / | | | | | | | | | | | | | | | | | | \ V / | | | | /| | | | http://site.com/.= Exploit/Comand/Sql= +union+select+1,2,3,4,5,6--+ Exploit/Comand/Xss= " Payload/Comand/Sql= tableschema=0x45F62771736573616C61667273 / tablename=0x6E6536C6574657461736...
ThinkSNS再来一枚sql注入漏洞
简要描述： 还是为了答谢你们送的水杯。 严重的sql注入 可爆任意密码 你懂的！ xss那就不用说了 详细说明： wap模块的搜索没有对关键字过滤 知道表名即可估计 好在我不知道官网的表名。只有本地测试了 漏洞证明： http://========/index.php?app=wap&mod=Index&act=doSearch 关键字输入 1' and 1=2 union select 1,2,3,password,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 from cqquser where uid=1 and 1='1...
[BeEF 0.4.3.8] Browser Exploitation Framework
The Browser Exploitation Framework BeEF is a powerful professional security tool. It is a penetration testing tool that focuses on the web browser. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security...
[Scylla] v1 Penetration Testing Tool - Because there's no patch for human stupidity
When there's no technical vulnerability to exploit, you should try to hack what humans left for you, and believe me, this always works. Scylla provides all the power of what a real audit, intrusion, exclusion and analysis tool needs, giving the possibility of scanning misconfiguration bugs...
[BackBox Linux] Version 3.0
BackBox is a Linux distribution based on Ubuntu Desktop, and designed for performing penetration testing, incident response, computer forensics, and intelligence gathering. It uses the Xfce desktop environment, and is developed by Raffaele Forte and a small but dedicated team. This release includ...
[ZAP] OWASP Zed Attack Proxy Weekly
The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration...
[SET] Social-Engineer Toolkit 4.1.3
TrustedSec Release the latest version of Social-Engineer Toolkit SET as 4.1.3. As most of us know that, It is an open source, python-driven, social-engineering penetration testing framework of custom tools which solely focuses on attacking the human element of penetration testing. It was designed...
HP Intelligent Management Center UAM Buffer Overflow
This module exploits a remote buffer overflow in HP Intelligent Management Center UAM. The vulnerability exists in the uam.exe component, when using sprint in a insecure way for logging purposes. The vulnerability can be triggered by sending a malformed packet to the 1811/UDP port. The module has...
Penetration Testing Frequently Asked Questions
You may have noticed this recent article about Googles contest that rewarded a hacker for discovering a vulnerability in Chrome. Once Google verified the vulnerability, they were able to fix the bug and issue the cash prize to the hacker. This is a very public example similar to what Coalfire Lab...
Layton Helpbox 4.4.0 Multiple Security Issues
Layton Helpbox 4.4.0 Multiple Security Issues: Layton Helpbox 4.4.0 Multiple SQL Injection Points CVE-2012-4971 http://www.reactionpenetrationtesting.co.uk/helpbox-sql-injection.html Layton Helpbox 4.4.0 Authorisation Bypass Vulnerability CVE-2012-4975...
IBM Rational ClearQuest Multiple Script Information Disclosure
The remote install of IBM WebSphere Application Server contains one or more testing and debugging scripts as well as sample applications, likely resulting from a deployment of IBM Rational ClearQuest. These scripts provide information such as system paths and versions, which may aid an attacker...
NASA Jet Propulsion Laboratory Vulnerable to Cross Site Scripting (XSS)
Yesterday, we report about the security breach in US Government computers belongs to NASA restricted area website and Hacker dump out the complete source code and files from server of the website. Today another hacker claim a quick XSS Cross site scripting Vulnerability in NASA's Jet Propulsion...
Layton Helpbox 4.4.0 Stored Cross Site Scripting
Layton Helpbox 4.4.0 Embedded Cross-Site Scripting by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to an embedded cross-site scripting vulnerability. CVE number: CVE-2012-4972 Impact: Medium Vendor homepage: http://www.laytontechnology.com Vendor notifie...
[SECURITY] [DSA 2563-1] viewvc security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2563-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 23, 2012 http://www.debian.org/security/faq -...
