xray

xray에 오신 것을 환영합니다 👋 강력한 보안 평가 도구 🏠사용 문서 • ⬇️xray 다운로드 • ⬇️xpoc 다운로드 • ⬇️xapp 다운로드 • 📖플러그인 저장소 English Version 참고: xray 시리즈는 오픈소스가 아니며, 빌드된 바이너리를 직접 다운로드하면 됩니다. 저장소에는 주로 커뮤니티에서 기여한 poc가 포함되어 있으며, xray가 릴리스될 때마다 자동으로 패키징됩니다. ✨ xray2.0 xray 1.0이 기능이 추가되면서 복잡해지고 비대해지는 문제를 해결하기 위해 xray 2.0을 출시했습니다...

cve-2022-22947

CVE-2022-22947 CVE-2022-22947를 위한 Poc DnsLog 나는 xray의 poc를 작성할 때, reverse가 Dns 요청을 받지 못해서 오랫동안 디버깅하다가, python 버전의 poc를 작성하기로 결정했습니다…… root@kitploit: python3 poc-cve-2022-22947.py...

Solr-SSRF

Solr-SSRF CVE-2021-27905 Burp 파일의 repeat 패키지에 재현 구체적 단계가 있습니다. POC는 Xray의 탐지 플러그인입니다...

reapoc

reapoc オープンソースPoC && 脆弱性ターゲット保管ボックス。 私たちは、検証のための様々な正規化されたPoCと脆弱性ターゲットを収集することを目指しています。 現在、reapocは以下のPoCをサポートしています: pocsploit: 私の新しいシンプルでスマートなPoCフレームワークです。ぜひご覧ください! nuclei: 世界的に有名な、yamlベース xray: yamlベース pocsuite3: python PoCフレームワーク...

super-xray

Super Xray 이 도구가 도움이 되셨다면 Star를 눌러서 작성자를 지원해주세요. 소개 xray는 훌륭한 취약점 스캐너이지만, 현재는 명령줄 버전만 제공되며 config.yaml 설정 파일로 실행됩니다. 많은 경우 사용이 쉽지 않아, 초보자가 더 쉽게 사용할 수 있도록 GUI 도구가 필요합니다. 이 도구는 단순히 명령줄을 감싼 것으로, 메서드를 직접 호출하지는 않습니다. xray의 로드맵에는 향후 완전한 GUI 버전의 XrayPro 도구가 포함될 예정이니 기대해주세요. 사용 전제 조건: 로컬에 JRE/JDK 8+ 환경이...

xray

XRay has been reimplemented in Rust and expanded with more features, this repository is LEGACY code. Usehttps://github.com/evilsocket/legba XRAY XRay is a tool for network OSINT gathering, its goal is to make some of the initial tasks of information gathering and network mapping automatic. How Do...

xray

XRayはRustで再実装され、より多くの機能が追加されました。このリポジトリはレガシーコードです。使用する場合はhttps://github.com/evilsocket/legba を利用してください。 XRAY XRayはネットワークOSINT収集のためのツールであり、その目標は情報収集とネットワークマッピングの初期タスクの一部を自動化することです。 どのように動作するか？ XRayは非常にシンプルなツールで、次のように動作します： 1. ワードリストとDNSリクエストを使用してサブドメインをブルートフォースします。 2...

GHSA-JM48-M3RR-9HGG 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-55477

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...

CVE-2026-55477

3X-UI before version 3.3.1 is affected. An authenticated administrator can abuse the database import functionality to write arbitrary files on the host by altering Xray configuration values stored in the database, enabling code execution and persistent access as the Xray process user (including r...

CVE-2026-55477

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...

CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...

CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...

PT-2026-52471

Name of the Vulnerable Software and Affected Versions 3X-UI versions prior to 3.3.1 Description An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leverag...

poc_regex

pocregex pocregex: Extract th...

CVE-2026-41173 Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

CVE-2026-41173

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

CVE-2026-41173

OpenTelemetry.Sampler.AWS is affected by an unbounded HTTP response body read in the AWS X-Ray remote sampler prior to 0.1.0-alpha.8. The AWSXRaySamplerClient.DoRequestAsync call reads the entire HTTP response into memory (ReadAsStringAsync) without size limits, enabling an attacker controlling o...