CMSsc4n

CMSsc4n Tool to identify if a domain has got a CMS and determine his version. At the moment, CMS's supported by CMSsc4n are WordPress,Moodle,Joomla,Drupal and Prestashop. Instalation You can download the latest version of CMSsc4n by cloning the GitHub repository: git clone...

CVE-2018-7600

CVE-2018-7600 Эксплоит Proof of Concept для Drupal CVE-2018-7600 — удаленное выполнение кода с псевдо-оболочкой и поддержкой прокси...

CVE-2018-7600

CVE-2018-7600 PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

drupalgeddon2

Drupalgeddon 2 Drupalgeddon 2 CVE-2018-7600 / SA-CORE-2018-002용 MSF 익스플로잇 모듈 Drupal 7.58 이전, 8.x 8.3.9 이전, 8.4.x 8.4.6 이전, 8.5.x 8.5.1 이전 버전은 기본 또는 일반적인 모듈 구성으로 여러 하위 시스템에 영향을 미치는 문제로 인해 원격 공격자가 임의 코드를 실행할 수 있도록 합니다. 이 모듈은 php/base64 인코더를 사용하여 msf PHP 아키텍처 페이로드를 로드할 수 있습니다. Drupal에서의 결과적인 RCE는 다음...

masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

masc

masc Un scanner de malwares web développé lors du Hackathon CyperCamp 2017 À propos Page d'accueil PyPI Fonctionnalités Actuellement, certaines fonctionnalités sont disponibles pour tout type de site web personnalisé ou CMS et d'autres uniquement pour des plateformes spécifiques : Scanner tout si...

jok3r

.. raw:: html .. image:: ./pictures/logo.png .. raw:: html Jok3r v3 beta .. image:: https://img.shields.io/badge/python-3.6-blue.svg :target: https://www.python.org/downloads/release/python-366/ :alt: Python 3.6 .. image:: https://readthedocs.org/projects/jok3r/badge/?version=latest :target:...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Вдохновлено https://github.com/dreadlocked/Drupalgeddon2 Поддерживает: Drupal 8.3.9 / 8.4.6 / 8.5.1 URL user/register, атака на account/mail и параметр postrender с использованием PHP-функции passthru В...

fad-checker

fad-checker AKA F ormidable A uditor's D ependency C hecker AKA F uckin' A utonomous D ependency C hecker fad-checker is a polyglot dependency auditor built for professional code audits. It scans 10 ecosystems + 9 CMS/Frameworks WordPress, Drupal, Symfony, Laravel… in one pass, with no build tool...

wapiti

============================================== Wapiti — сканер уязвимостей веб-приложений .. image:: https://img.shields.io/pypi/v/wapiti3?label=PyPI&logo=PyPI&logoColor=white&color=blue :alt: PyPI version :target: https://pypi.python.org/pypi/wapiti3 .. image::...

exphub

Avis Après tout, je trouvais que c'était peu pratique d'avoir un script séparé pour chaque vulnérabilité, j'ai donc regroupé tous les scripts POC et EXP en un seul, permettant un scan et une exploitation en un clic. Comme je me suis concentré sur l'intégration récemment, Exphub est resté longtemp...

hacktronian

Pentesing Tools That All Hacker Needs. HACKTRONIAN Menu : Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation Install The HACKTRONIAN Information Gathering: Nmap Setoolkit Port Scanning Host To IP wordpre...

hacktronian

Outils de Pentesing dont tout Hacker a besoin. Menu HACKTRONIAN : Collecte d'informations Attaques par mot de passe Tests sans fil Outils d'exploitation Sniffing et Spoofing Hacking Web Hacking Web Privé Post-exploitation Installer HACKTRONIAN Collecte d'informations : Nmap Setoolkit Port Scannin...

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. id: CVE-2018-9205 info: name: Drupal avataruploader v7.x-1.0-beta8 - Local File Inclusion author: daffainfo severity: high description: In avataruploader...

Drupal 7 CKEditor XSS

CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...

Drupal LocalGov Workflows < 1.6.0 - Information Disclosure

Drupal LocalGov Workflows 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges. id: CVE-2026-10768 info: name: Drupal LocalGov Workflows 1.6...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE Этот репозиторий содержит локальную лабораторию и короткий эксплойт для SQL-инъекции в Drupal JSON:API PostgreSQL, описанной в статье Ambionics. Важная часть эксплойта — эскалация привилегий PostgreSQL: когда инъекция может вычислить выражение SELECT ка...

Audit-BlackBox-Web-to-Root

Pentest Lab : Chaîne d'exploitation web et système Drupal to Root Disclaimer Ce projet a été réalisé dans un environnement de laboratoire contrôlé et isolé à des fins éducatives et académiques. Aucune infrastructure réelle n'a été ciblée. L'objectif est d'apprendre à sécuriser les systèmes en...