struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

CVE-2023-37582_EXPLOIT

CVE-2023-37582EXPLOIT Apache RocketMQ Arbitrary File Write Vulnerability Exploit Demo Overview In fact, the Arbitrary file write vulnerabilityCVE-2023-37582 in Apache RocketMQ has already been addressed in the CVE-2023-33246 RCE vulnerability. However, the fix provided for CVE-2023-33246 RCE is n...

CVE-2023-22515

Confluence Vulnerability - CVE-2023-22515 📓 Introduction Atlassian was informed about a possible vulnerability that could be exploited and compromising the environment through administrative access. On October 4, 2023, Atlassian released a security advisory regarding CVE-2023-22515 which got a CV...

CVE-2024-21733

CVE-2024-21733-POC Notes: 1. tomcat English environment 2. Specific constructed backend code, as shown in ROOT/vulnerable.jsp 3. If needed, modify the server address and port in the script. Default 127.0.0.1:8080 4. Timeout trigger, default 20 seconds, usually less than this time Process: 1...

struts_hack

This tool uses an exploit in the Apache Struts framework called CVE-2017-5638 to gain access to a vunerable server through an OGNL injection. It can be downloaded here you will need to run it from the command line Usage: strutshack target IP target port...

apachedos

This tool uses CVE-2016-8740 to crash servers running Apache HTTPD 2.4.17 - 2.4.23 that support HTTP2. It crashes these servers by forcing them to allocate insanely large amounts of RAM, making the computer unuasable. It can be downloaded here you will need to run it from the command line Usage:...

zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check

A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List ACL permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This c...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

tc_hack

This tool uses a vulrubility within Apache Tomcat called CVE 2017 12617 to gain remote access to any server with the PUT method enabled. It can be downloaded here you will need to run it from the command line Usage: tchack target IP target port...

POC-CVE-2021-41773

POC-CVE-2021-41773 On the 5th of October 2021, a CVE detailing a path traversal attack on Apache HTTP Server v2.4.49 was released. Assigned the number CVE-2021-41773, it was released with the following description: A flaw was found in a change made to path normalization in Apache HTTP Server...

cve-2021-44228

CVE-2021-44228 https://nvd.nist.gov/vuln/detail/CVE-2021-44228 log4j.java - modification of this PoC https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce to run a bunch of payloads from JNDIExploit. jndi.pcap - a PCAP of each of these payloads being ran. snort.rules - Snort rules to...

cve-2021-42013

Apache 2.4.50 - Path Traversal or Remote Code Execution CVE-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-42013 If CGI-BIN is enabled...

Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs Source IPs attempting attacks using Apache Log4j RCE, including a large number of Tor nodes, see Attack-IP.md IOCs for malware, botnets, etc. propagated via the Log4j vulnerability, see IOC-C2.md Snort detection rules, see Snort.md Suricata rules, see...

-CVE-2017-9805-

Vulnerability information Resources: https://vulners.com/cve/CVE-2017-9805 What is this? A python exploit script capable of executing remote commands into the shell of a system hosting a Struts2 vulnerable to S2-052. Usage python s2-052.py --target 'http://192.168.0.233/orders/3' --command "echo...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

CVE-2022-33980

CVE-2022-33980 CVE Apache Commons RCE can use url,dns,script key-words to connect any server...

CVE-2023-33246

CVE-2023-33246 Apache RocketMQ Remote Code Execution Vulnerability CVE-2023-33246 Exploit Usage: java -jar CVE-2023-33246.jar -ip "127.0.0.1:10911" -cmd "open -a Calculator" Features of This Tool Since the heartbeat mechanism triggers the vulnerability every 30 seconds, the tool introduces a...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache MyFace (CVE-2026-68536, CVE-2026-76646)

Summary There are vulnerabilities in the Apache MyFace library that affects IBM WebSphere Application Server and WebSphere Application Server Liberty when jsf-2.0, jsf-2.2, jsf-2.3, faces-3.0, faces-4.0 or faces-4.1 is enabled. Vulnerability Details CVEID:CVE-2026-76646 DESCRIPTION: A remote...

apache-struts2-CVE-2017-5638

apache-struts2-CVE-2017-5638 Demo Application and Exploit Sample Apache Struts2 App Struts2-showcase: https://mvnrepository.com/artifact/org.apache.struts/struts2-showcase/2.3.12 Exploit Reference: https://github.com/rapid7/metasploit-framework/issues/8064...