183690 matches found
cve-2024-0012-gui-poc
CVE-2024-0012 and CVE-2024-9474 Authentication Bypass in the Management Web Interface PAN-SA-2024-0015 and Authenticated Command Injection in Palo Alto PAN-OS. See the blog post for technical details. Exploit authors Original exploit written by Sonny of watchTowr @watchtowrcyber. Code and GUI...
CVE-2021-24019
CVE-2021-24019 Exploit FortiClient EMS 6.2.6 - Authentication Bypass Exploit Overview This script automates session token validation to test if authentication can be bypassed in FortiClient EMS 6.2.6. The user provides the target, and the script checks a list of session tokens for valid access...
mssqli-duet
MSSQLi-DUET - MSSQL Injection-based Domain User Enumeration Tool SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions...
BurpSuite_403Bypasser
403Bypasser An burpsuite extension to bypass 403 restricted directory. By using PassiveScan default enabled, each 403 request will be automatically scanned by this extension, so just add to burpsuite and enjoy. Payloads: $1: HOSTNAME $2: PATH root@kitploit: $1/$2 $1/%2e/$2 $1/$2/. $1//$2//...
bore
bore Rust로 작성된 현대적이고 간단한 TCP 터널로, 표준 NAT 연결 방화벽을 우회하여 로컬 포트를 원격 서버에 노출합니다. 이것이 전부입니다: 그 이상도 이하도 아닙니다. root@kitploit: 설치 Rust 필요, 아래 대안 참조 cargo install bore-cli 로컬 머신에서 bore local 8000 --to bore.pub 이렇게 하면 로컬 포트 localhost:8000이 bore.pub:를 통해 공개 인터넷에 노출됩니다. 여기서 포트 번호는 무작위로 할당됩니다. localtunnel 및...
doublepulsar-usermode-injector
DOUBLEPULSAR-usermode-injector 著者: Matt Hillman [email protected] - @sp1nl0ck 会社: Countercept @countercept ウェブサイト: https://countercept.com DOUBLEPULSARペイロードのユーザーモードシェルコードを利用して、任意のDLLを別のプロセスにリフレクティブにロードするユーティリティです。検知技術のテストやその他のセキュリティ研究を目的としています。 背景 Shadow...
OverThruster
OverThruster "I've been ionized, but I'm okay now." -Buckaroo Banzai. General Info OverThruster is a tool to generate sketches for Arduinos when used as an HID Attack. It was designed around devices with the ATMEGA32U4 chip, like the CJMCU-BEETLE, or the new LilyGo "BadUSB" devices popping up on...
starlette-host-header-lab
Starlette Host-Header URL Confusion Lab X41-2026-002 A self-contained, containerized training lab reproducing the Starlette authentication-bypass vulnerability disclosed by X41 D-Sec. Advisory: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Interpretation Conflict / Untrusted Input in Function...
CVE-2026-8181-Lab
CVE-2026-8181 — Burst Statistics Authentication Bypass Lab Local-only Docker lab for CVE-2026-8181 , an authentication bypass in the WordPress plugin Burst Statistics – Privacy-Friendly WordPress Analytics. This lab compares a vulnerable plugin version against the patched version and uses a...
CVE-2022-46169
Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...
CVE-2026-91949
A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security RDSTLS connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can...
CVE-2021-27876
CVE-2021-27876 Unauthenticated RCE exploit for Veritas Backup Exec Agent CVE-2021-27876/77/78 — SHA auth bypass to SYSTEM via NDMP CVEs CVE| Description| CVSS 3.1 ---|---|--- CVE-2021-27876| Authentication bypass via SHA hash manipulation in the NDMP protocol| 9.8 Critical CVE-2021-27877|...
Burp-Encode-IP
About This extension will encode an IP address into a bunch of less known encoding techniques. This technique is focused on testing vulnerabilities such as SSRF Server-Side Request Forgery, Open Redirect or RFI Remote File Inclusion. TL;DR Easy Install If you have Burp Pro it is possible to insta...
frameless-bitb
Frameless BITB iframe을 사용하지 않는 새로운 브라우저 인 브라우저BITB 방식입니다. Microsoft와 같은 로그인 페이지에서 구현된 기존의 프레임 버스터를 우회할 수 있습니다. 이 POC 코드는 이 새로운 BITB를 Evilginx 및 Microsoft Enterprise 피싱릿과 함께 사용하기 위해 제작되었습니다. 본격적으로 알아보기 전에, 제가 BSides 2023에서 이 개념을 처음 소개하고 "완벽한" 피싱 공격을 구성하는 방법에 대한 중요한 세부 정보를 다룬 발표를 먼저 확인하시길 권장합니다. ▶...
CVE-2017-16778-Intercom-DTMF-Injection
Invoking DTMF Tones for Physical Access Grant on Fermax Lift Intercom System CVE-2017-16778 Special Mentions First and foremost, @dizijoyjoy for assisting on the demo set in order for a successful shoot. Special acknowledgement to Fermax for the prompt response to the security bug report on their...
Python-Rootkit
python-rootkit This is a full undetectable python RAT which can bypass almost all antivirus and open a backdoor inside any windows machine which will establish a reverse https Metasploit connection to your listening machine. ViRu5 life cycle Bypass all anti-virus. Inject a malicius powershell...
initroot
initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies First stage exploit: Tethered jailbreak This exploit gains an ephemeral unrestricted root access on the device. For example, on cedric some...
CVE-2000-0979
CVE-2000-0979 CVE-2000-0979.rb is the standalone tool to exploit CVE-2000-0979 against Windows 95 SMB service. msf20000979.rb is the Metasploit module. You can copy this to metasploit-framework ▸ modules ▸ auxiliary ▸ scanner ▸ smb More documentation coming soon! Original advisory NSFOCU...
Pyrescom-Termod-PoC
Pyrescom-Termod-PoC This is the Proof-of-concept exploit code for three vulnerabilities discovered by Jonas Mattsson and Hugo van den Toorn at Outpost24 Ghost Labs. These vulnerabilities are discovered in the web server component on a Pyrescom Termod4 time control machine. These vulnerabilities c...