xmlrpc-brute

WordPress XML-RPC Bruteforce Tool A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface. Description This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standar...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

WS-Attacker

WS-Attacker WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum https://nds.rub.de/ and the Hackmanit GmbH https://hackmanit.de/. The basic idea behind WS-Attacker is to provide a functionality ...

CVE-2023-20198

CVE-2023-20198 An Exploitation script developed to exploit the CVE-2023-20198 Cisco zero day vulnerability on their IOS XE Hackers have been widely exploiting the this vulnerability which creates a 15 level privilege user by bypassing the authentication Which a malicous xml content make this...

AbxOverflow

यहाँ वर्णित समस्या के फिक्स CVE-2024-34740 / A-307288067 के अंतर्गत सामने आए: बुलेटिन बुलेटिन से लिंक किया गया पैच दो अन्य पैच: 1 2 Android Binary XML Android systemserver के अंदर, कई सेवाएँ रिबूट्स के बीच अपनी स्थिति को XML फ़ाइलों में संग्रहीत करती हैं $ adb shell su 0 find /data/system -name...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

Digital-Signature-Forgery-Attack

In this article, we will look at the cryptographic attack of digital signature forgery Digital Signature Forgery Attack, its consequences pose a threat to the security of transactions in the Bitcoin network, since digital signatures confirm the ownership and authorization of cryptocurrency...

evtx

EVTX Windows XML EventLog प्रारूप के लिए एक क्रॉस-प्लेटफ़ॉर्म पार्सर विशेषताएँ 🔒 100% सुरक्षित रस्ट का उपयोग करके कार्यान्वित - और रस्ट द्वारा समर्थित सभी प्लेटफार्मों पर काम करता है जिनके पास stdlib है। ⚡ तेज़ - नीचे बेंचमार्क देखें। यह किसी भी अन्य कार्यान्वयन की तुलना में परिमाण के क्रम क्रमों...

CVE-2019-0604

1. Analysis of k8gege's cve-2019-0604-exp.py k8gege's script https://github.com/k8gege/CVE-2019-0604 Honestly, k8gege's Python script is a bit fancy, with a large number of hexadecimal strings split into payload1, 2, 3. Devious. The Python script sends a remote POST payload, which after...

FileWatchTower

FileWatchTower - FWT NOTE: This project is no longer maintained and has been published from archived projects for reference. It is available for anyone interested in developing file analysis software. FWT is a security analysis and file monitoring tool that utilizes Sysmon events. It tracks files...

CVE-2019-2888

CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE भेद्यता https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class root@kitploit: ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

CVE-2017-11610

CVE-2017-11610 Unauthenticated Reverse Shell RCE for Supervisor 3.0a1 - 3.3.2 Standalone Python ≥3.6 Unauthenticated RCE exploit for Supervisor 3.0a1 to 3.3.2, rewritten from this Metasploit module. Explanatory post here. Tested with Python 3.7 on this target runing Supervisor 3.3.2 Usage:...

doctrack

Doctrack Office Open XML दस्तावेज़ों को हेरफेर और हथियार बनाने का उपकरण। विशेषताएँ Office Open XML दस्तावेज़ बनाएँ Word, Excel ट्रैकिंग पिक्सेल और UNC पथ सम्मिलित करें रिमोट टेम्पलेट इंजेक्शन CustomXML भाग सम्मिलित करें बाहरी लक्ष्य URL, मेटाडेटा और Custom XML भागों का निरीक्षण करें स्थापना आपको...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

CVE-2023-46604-ActiveMQ-RCE-pseudoshell

CVE-2023-46604 RCE Pseudoshell This script leverages CVE-2023046604 Apache ActiveMQ to generate a pseudo shell. The vulnerability allows for remote code execution due to unsafe deserialization within the OpenWire protocol. Description CVE-2023-46604 is a deserialization vulnerability that exists ...

CVE-2023-21939

JDK CVE-2023-21939 文章链接 This is JDK CVE-2023-21939 Use JDK version lower than 8u371 JDK + Apache XML Graphics root@kitploit: org.apache.xmlgraphics batik-swing 1.15 How to reproduce this RCE: 1 Run XmlServer.java 2 Run JarServer.java 3 Run JarRCE.java for Test and successfully RCE Screenshot: JDK...

cve-2023-45612_exploit

cve-2023-45612exploit CVE-2023-45612 एक उच्च गंभीरता वाली सुरक्षा समस्या है जो Ktor के XML सीरियलाइज़ेशन पर XXE XML eXternal Entity हमलों की अनुमति देती है, जिसे 2023 में पैच किया गया था। सुरक्षा समस्या का पुनरुत्पादन नीचे विस्तृत तरीका दिया गया है कि मैंने समस्या को कैसे पुन: उत्पन्न किया।...

CVE-2024-45427-Exploit

CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...

x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...