CVE-2020-25068

CVE-2020-25068 Python exploit for Conacwin v3.7.1.2. Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/filetodisclose Directory Traversal...

CVE-2026-49179-Active-Directory-WriteSPNScript-Command-Injection

CVE-2026-49179: Active Directory WriteSPNScript Command Injection Summary Field| Value ---|--- CVE ID| CVE-2026-49179 CVSS| 8.8 AV:N/AC:L/PR:L/UI:N CWE| CWE-77 Command Injection Affected Component| ntdsai.dll — WriteSPNScript function Affected Systems| Windows Server 2016, 2019, 2022, 2025...

rebel

This repository does not have a README...

aclpwn.py

aclpwn.py Aclpwn.py는 BloodHound와 연동하여 ACL 기반 권한 상승 경로를 식별하고 악용하는 도구입니다. 시작점과 끝점을 입력하면 Neo4j 경로 탐색 알고리즘을 사용하여 가장 효율적인 ACL 기반 권한 상승 경로를 찾습니다. Aclpwn.py는 PowerShell 기반의 Invoke-Aclpwn과 유사하며, 저희 블로그에서 자세히 알아볼 수 있습니다. 종속성 및 설치 Aclpwn.py는 Python 2.7 및 3.5+와 호환됩니다. neo4j-driver, impacket 및 ldap3 라이브러리가...

SOC_287

SOC287 - Arbitrary File Read on Checkpoint Security Gateway CVE-2024-24919 Overview This repository contains a detailed walkthrough of the CVE-2024-24919 vulnerability affecting Check Point Security Gateways. The vulnerability allows arbitrary file read, potentially exposing sensitive system file...

CVE-2024-23334-PoC

CVE‑2024‑23334 Path Traversal - PoC I created this script to automate the exploitation of CVE‑2024‑23334 on the Hack The Box Chemistry machine. This vulnerability affects aiohttp versions ≥ 1.0.5 and 3.9.2 when the application is configured to serve static files with followsymlinks=True, allowing...

CVE-2026-17609

The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to unauthenticated arbitrary directory deletion . The flaw exists in the submit_form function due to insufficient validation of attacker-controlled JSON field declarations against the form schema. Specifically,...

EUVD-2026-94736

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

Set-AuditRule

Set-AuditRule A repository of useful access control entries ACE that could be added to the system access control list SACL of a securable object's security descriptor to monitor potential adversarial activity. These entries are categorized by specific securable objects such as files, registry key...

modifyCertTemplate

Purpose This tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation and then reset the template to its previous state afterwards. This is specifically designed for a scenario where WriteProperty righ...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

binwally

binwally Fuzzy Hashing 개념ssdeep을 사용하는 바이너리 및 디렉터리 트리 비교 도구 자세한 정보: http://w00tsec.blogspot.com/2013/12/binwally-directory-tree-diff-tool-using.html 전제 조건: Python 2.7+ gcc 및 빌드 필수 요소 libffi apt-get install libffi-dev libfuzzy-dev apt-get install libfuzzy-dev python-dev apt-get install python-dev...

Grafana-Decryptor-for-CVE-2021-43798

Grafana Decryptor for CVE-2021-43798 This script decrypts the DataSource passwords from a Grafana instance vulnerable to CVE-2021-43798, which allows unauthorized arbitrary file reading. Description Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a directory traversal vulnerability...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

CVE-2026-105816

A flaw was found in Vault. This vulnerability allows a privileged operator to achieve arbitrary code execution on the underlying host system. Vault does not consistently verify that stored plugin catalog entries reference binaries located within the designated plugin directory. In configurations...

CVE-2019-1002101-Helpers

kubectlcpCVE-2019-1002101 PoC helper scripts and Dockerfile for CVE-2019-1002101 For detailed info, goto https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/ and...

fastfuz-chrome-ext

FastFuzz Chrome 확장 프로그램 Chrome 확장 프로그램으로 웹사이트를 빠르게 퍼징합니다. 스크린샷 설치 나만의 커스텀 파일 추가 files.txt 열기 파일 또는 디렉토리 이름을 한 줄씩 붙여넣기 즐거운 헌팅 되세요 할 일 응답 크기 발견 사항 추가 새로운 특정 파일 및 디렉토리 이름 추가 확장 프로그램을 Chrome 웹 스토어에 추가...

fastfuz-chrome-ext

FastFuzz Chrome Extension Fast fuzzing websites with chrome extension Screenshot Install Add Your Custom Files Open files.txt Paste your file or directory name in line by line Happy Hunting TODO Add response size foundings Add new specific file and directory names Add Extension to chrome extensio...

PSPKIAudit

PSPKIAudit PowerShell toolkit for auditing Active Directory Certificate Services AD CS. It is built on top of PKISolution's PSPKI toolkit Microsoft Public License. This repo contains a newer version of PSPKI than what's available in the PSGallery see the PSPKI directory. Vadims Podans the creator...