Passive DNS Network Mapper: dnsmap

Passive DNS Network Mapper dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments . During the enumeration stage, the security consultant would typically discover the target company’s IP netblocks, domain names,...

V-CMS Login Utility

This module attempts to authenticate to an English-based V-CMS login interface. It should only work against version v1.1 or older, because these versions do not have any default protections against brute forcing. This module requires Metasploit: https://metasploit.com/download Current source:...

Dolibarr ERP/CRM Login Utility

This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface, and should only work against version 3.1.1 or older, because these versions do not have any default protections against brute forcing. This module requires Metasploit: https://metasploit.com/download Current source:...

R2 1.65 Stack Overflow / Directory Traversal / Brute Forcing

Luigi Auriemma Application: R2 http://www.rabidhamster.org/R2/ Versions: = 1.65 Platforms: Windows Bugs: A stack overflow B directory traversal C PIN brute forcing Exploitation: remote Date: 09 Feb 2012 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bugs 3 Th...

Apache Log Extractor tool

Apache Log Extractor tool Apache Log Extractor is a quick script to export URL information from Apache access logs. The thought behind this script was to provide a list of known URL's on a remote server by analysing the logs. This list could then be used as the input for further testing tools e.g...

Metasploit 3.5.1 adds Cisco device exploitation !

Metasploit now enables security professionals to exploit Cisco devices, performs passive reconnaissance through traffic analysis, provides more exploits and evaluates an organization's password security by brute forcing an ever increasing range of services. This latest release adds stealth...

Accton-based switches (3com, Dell, SMC, Foundry, EdgeCore) Backdoor

Exploit for windows platform in category remote exploits =================================================================== Accton-based switches 3com, Dell, SMC, Foundry, EdgeCore Backdoor =================================================================== On the 15th of august 2009, at the...

Research: Weird Works When It Comes to Passwords

Researchers at Microsoft and Harvard University warn that popular passwords pose a bigger risk to online security than weak ones and suggest that many tools to enforce strong passwords actually steer users to choices that are easy to guess. Forcing users to choose passwords that are rare and...

Drupal Views Module Users Enumeration

This module exploits an information disclosure vulnerability in the 'Views' module of Drupal, brute-forcing the first 10 usernames from 'a' to 'z'. Drupal 6 with 'Views' module use auxiliary/scanner/http/drupal/viewsuserenum msf undefinedviewsuserenum show actions ...actions... msf...

Oxygen2PHP 1.1.3 - 'forumdisplay.php' Blind SQL Injection

!/usr/bin/perl 0-Day Oxygen2PHP newGET = $Host; my $HTTP = new LWP::UserAgent; my $Referrer = "http://warwolfz.altervista.org/"; my $DefaultTime = request$Referrer; sub BlindSQLJnjection my $dec,$hex = @; return "./forumdisplay.php?fid=-1'+OR+1!=SELECT...

cartweaver3-sql.txt

!/usr/bin/perl Cartweaver 3 PHP Blind SQL Injection Substring Vulnerability Bug by: h0yt3r Dork: n/a brainusing required Releasing it to the public No error messages are being returned. Exploit need a vaild Product ID! SQL Injection: http://target/path/details.php?prodId=SQL Gr33tz go to: b!zZ!t,...

GNU Mailutils imap4d 0.6 Remote Format String Exploit (exec-shield)

No description provided by source. / Fedora Core 6 exec-shield based GNU imap4d mailutils-0.6 search remote format string exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference:...

GNU Mailutils imap4d 0.6 - exec-shield Remote Format String

/ Fedora Core 6 exec-shield based GNU imap4d mailutils-0.6 search remote format string exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference: https://www.securityfocus.com/bid/14794 2005/09/09...

FreeBSD : fetchmail -- insecure APOP authentication (f1c4d133-e6d3-11db-99ea-0060084a00e5)

Matthias Andree reports : The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called 'APOP' which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accept...

SoftBB 0.1 - 'mail' Blind SQL Injection

!/usr/bin/env python LOTFREE TEAM 03/2006 http://lotfree.next-touch.com/ http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py Vulnerability info Product : SoftBB Version : 0.1 The field 'mail' in reg.php is used directly in a SQL query : $sql = 'SELECT pseudo,mail FROM '.$prefixtable.'membres...

SoftBB 0.1 - mail Blind SQL Injection

SoftBB 0.1 - mail Blind SQL Injection !/usr/bin/env python LOTFREE TEAM 03/2006 http://lotfree.next-touch.com/ http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py Vulnerability info Product : SoftBB Version : 0.1 The field 'mail' in reg.php is used directly in a SQL query : $sql = 'SELECT...

SoftBB 0.1 (mail) Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/env python LOTFREE TEAM 03/2006 http://lotfree.next-touch.com/ http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py Vulnerability info Product : SoftBB Version : 0.1 The field 'mail' in reg.php is used directly in a SQL query : $sql = 'SELECT...

[Full-disclosure] Rockliffe Mailsite User Enumeration Flaw

Synopsis: Rockliffe's Mailsite Mail Management Server User Enumeration Flaw. Product: Rockliffe Mailsite http://www.rockliffe.com Version: Confirmed on Mailsite = 7.0.3.1 Author: Josh Zlatin-Amishav Date: January 4, 2006 Background: Rockliffe MailSite secure email server software and MailSite MP...

Debian DSA-212-1 : mysql - multiple problems

While performing an audit of MySQL e-matters found several problems : signed/unsigned problem in COMTABLEDUMP Two sizes were taken as signed integers from a request and then cast to unsigned integers without checking for negative numbers. Since the resulting numbers where used for a memcpy...

Multiple Vulnerabilities in Cloisterblog web blog/journal

Executive Overview ------------------ Cloisterblog, a general usage web blog written in perl suffers from multiple XSS and directory transversal issues as well as a design flaw in the admin section. Program Description -------------------- Cloisterblog...