kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Console terminal et Web pour Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

CVE-2020-17453-PoC

CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. PoC Proof of Concept https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Discoverers Name: Jackson Henry Twitter: @JacksonHHax Name: Nicholas Young...

killchain

killchain “Kill Chain” est une console unifiée avec un anonymiseur qui exécutera ces étapes d'attaque : Reconnaissance Armement Livraison Exploitation Installation Commande et Contrôle Et Actions Les ensembles d'outils dépendants sont : 1. Tor -- Pour l'Anonymiseur intégré à la console. 2. Set --...

WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting

WSO2 Management Console through 5.10 is susceptible to reflected cross-site scripting which can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests. id: CVE-2020-17453 info: name: WSO2 Carbon Management...

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials sa/juggle are known. An unauthenticated remote attacker can reach the console and, using th...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

Oracle iPlanet Web Server 7.0.x - Image Injection

Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. id: CVE-2020-9314 info: name: Oracle iPlanet Web Server 7.0.x - Image Injection author:...

shimit

shimit shimit est un outil Python qui implémente l'attaque Golden SAML. Plus d'informations à ce sujet se trouvent dans l'article suivant sur notre blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

OwnershipStealer

OwnershipStealer This C code is a console application that attempts to take ownership of a specified file. Code Logic The program first checks if a file name was specified as a command line argument, and if not, prompts the user to enter one. It then proceeds to try and take ownership of the file...

NoFilter

NoFilter Tool for abusing the Windows Filtering Platform for privilege escalation. It can launch a new console as "NT AUTHORITY\SYSTEM" or as another user that is logged on to the machine. Usage Usage: NoFilter.exe -s SESSIONID Credits Ron Ben Yizhak References DEF CON talk...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

woodpecker-plugins

woodpecker-plugins usage Copy the plugins to the woodpecker-framwork/plugin directory and start java -jar woodpecker-framework.1.3.3.jar from https://github.com/woodpecker-appstore weblogic-info check T3 isOpen: echo 't3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n'|nc...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

ai-agent-gateway

@tuskira/gateway-web Admin console for the Tuskira AI Agent Gateway. React 19 + Vite + TypeScript strict + Tailwind CSS 4 + shadcn/ui. Develop Requires Node 26+ and npm 11+ no pnpm. npm install npm run dev The dev server proxies /api to http://localhost:8081 see vite.config.ts, so run the gateway...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

CVE-2023-33731

CVE-2023-33731 — eScan Management Console: Reflected Cross-Site Scripting XSS -orange Table of Contents Overview Vulnerability Details Severity & CVSS Score Affected Product Technical Analysis Proof of Concept Impact Mitigation & Remediation Disclosure Timeline References Author Overview A...

CVE-2023-33730

CVE-2023-33730 — eScan Management Console Privilege Escalation Severity: Critical CVE ID: CVE-2023-33730 Disclosed: 30 May 2023 Author: Sahil Ojha Table of Contents Overview Vulnerability Details Impact Technical Analysis Proof of Concept Remediation References Disclaimer Overview eScan Managemen...

wordpress-exploit-framework

WordPress Exploit Framework Un framework Ruby conçu pour faciliter les tests de pénétration de systèmes WordPress. Installation Pour installer la version stable la plus récente, exécutez gem install wpxf. Après l'installation, vous pouvez lancer la console WordPress Exploit Framework en exécutant...

msf-remote-console

Not mantained This tool won't be mantained by me anymore. There are better alternatives from Rapid7 themselves as descrived here: How to run metasploit remotley Example: To make msf commands viable from elsewhere then the metasploit-framework directory set the GEMHOME variable. To find the...