CVE-2022-44877

CVE-2022-44877 概要 このbashスクリプトは、CVE-2022-44877に対するWebサーバの脆弱性をテストするために使用されます。スクリプトは、base64でエンコードされたペイロードを含むcurlリクエストをターゲットURLに送信します。ターゲットがCVE-2022-44877の脆弱性を持つ場合、curlリクエストの経過時間が3.5秒を超えます。 インストール root@kitploit: sudo apt-get update sudo apt-get install curl bc git clone...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb 概念実証 説明 CVE-2026-49975（別名 HTTP/2 Bomb ）は、ほとんどの主要なWebサーバーのデフォルトのHTTP/2設定に影響を与えるリモートサービス拒否（DoS）脆弱性です。 この脆弱性は、OpenAI Codex によって、10年前から知られている2つの技術を組み合わせて発見されました： HPACK Bomb : ネットワーク上の1バイトがサーバー上で完全なヘッダー割り当てに変換されます Slowloris式ホールド : メモリ解放を防ぐゼロバイトのフロー制御ウィンドウ 影響を受けるサーバー...

vulmap

🌟 Vulmap - Web vulnerability scanning and verification tools Click here for the English Version Vulmap is a web vulnerability scanning and verification tool. It can scan and exploit vulnerabilities in webapps. Currently supported webapps include activemq, flink, shiro, solr, struts2, tomcat, unom...

cookiescanner

cookiescanner 여러 사이트에서 쿠키 플래그를 확인하는 도구 소개 여러 웹 서버를 분석할 때 쿠키 플래그를 확인하는 과정을 더 쉽게 하기 위해 만들어진 도구입니다. 이 도구가 왜 유용할 수 있는지 알고 싶다면? https://www.owasp.org/index.php/SecureFlag https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/Testingforcookiesattributes%28OTG-SESS-002%29 사용법...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

CVE-2023-44487-HTTP-2-Rapid-Reset-Attack

PoC - CVE-2023-44487: HTTP/2 Rapid Reset Attack このリポジトリには、CVE-2023-44487 （別名 HTTP/2 Rapid Reset Attack ）の脆弱性の悪用を実証する Proof of Concept（PoC）が含まれています。この脆弱性は HTTP/2 プロトコルに影響を与え、攻撃者が RSTSTREAM を使ってすばやく閉じられるストリームを利用して Web サーバーに過大な負荷をかけることを可能にします。 📌 説明 CVE-2023-44487 は HTTP/2...

HTTP-Basma

Fingerprinting Adaptativo: Sondeo Multi-Etapa de HTTP-Basma para la Diferenciación Granular de Servidores HTTP-Basma está disponible en https://httpbasma.netomize.ca/ Introducción En el ámbito de la ciberseguridad, identificar y caracterizar con precisión los servidores web es crucial para la...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 説明 このリポジトリには、CVE-2023-44487 として識別される HTTP/2 Rapid Reset 脆弱性の概念実証 PoC コードが含まれています。 脆弱性の概要 CVE ID : CVE-2023-44487 影響 : サービス拒否 DoS 影響を受けるプロトコル : HTTP/2 影響を受けるコンポーネント : Webサーバー、リバースプロキシ、ロードバランサー 公開日 : 2023-10-10 はじめに 前提条件 Python 3.x hyper 前提条件のインストール: root@kitploit...

CVE_2023_44487-Rapid_Reset

CVE-2023-44487 HTTP/2 Rapid Reset テストツール - 拡張版 CVE-2023-44487 （HTTP/2 Rapid Reset 脆弱性）のための包括的な Python テストツールです。この拡張版では、テストパラメータの詳細な制御、複数の攻撃パターン、高度な監視機能を提供します。 ⚠️ 重要なお知らせ このツールは教育目的および許可を得たテスト専用です！ 自分が所有するシステム、または明示的な書面による許可を得たシステムに対してのみ使用してください 無許可での使用は違法となる可能性があり、サービス障害を引き起こす恐れがあります...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Descrizione Questo repository contiene il codice proof-of-concept PoC per la vulnerabilità HTTP/2 Rapid Reset identificata come CVE-2023-44487. Panoramica della vulnerabilità ID CVE : CVE-2023-44487 Impatto : Denial of Service DoS Protocolli interessati : HTTP/2...

EUVD-2024-55705

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

CVE-2026-60364

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2026-60365

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

PT-2026-62459

Name of the Vulnerable Software and Affected Versions Oracle Weblogic Server Proxy Plug-in version 15.1.1.0.0 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Weblogic Server Proxy Plug-in. This issue allows for the unauthorized creation, deletion, or...

PYSEC-2026-1617 Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Description The Model Context Protocol MCP Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured...

The vulnerability of the modular interface between web servers and web applications in Rack, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the modular interface between web servers and Rack web applications is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20260609-73-0009

The vulnerability of the ngxhttpsslmodule module in NGINX Plus and NGINX Open Source web servers is related to the use of memory after deallocation. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and accessibility of protected information...

ROS-20260609-73-0014

The vulnerability of the ngxhttprewritemodule module in NGINX Plus and NGINX Open Source web servers is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...