flask-session-cookie-manager

Flask Session Cookie Decoder/Encoder Original author : Wilson Sumanang Fixes and improvements author : Alexandre ZANNI Imported from saruberoz.github.io Depencencies Python 2 or Python 3 itsdangerous Flask Installation Package BlackArch Linux pacman -S flask-session-cookie-manager3,2 Git ArchLinu...

CVE-2020-5902_RCE

CVE-2020-5902RCEEXP Blog: http://www.svenbeast.com/post/cve-2020-5902 Read File Example: https://x.x.x.x/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd HTTP/1.1 Host: 127.0.0.1 Connection: close...

xss_vulnerability_challenges

XSS Vulnerability Scenarios challenges This repository is a Dockerized php application containing some XSS vulnerability challenges. The ideas behind challenges are: Javascript validation bypass html entities bypass WAF bypass Black-list validation bypass Basic XSS validation bypass Double encode...

multiscanner

MultiScanner Introduction MultiScanner is a file analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output. Tools can be custom built Python scripts, web APIs, software running on another machine, etc...

CVE-2023-41717

CVE-2023-41717 Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. Executive Summary During the summer of 2022, I have found a vulnerability affecting the ZScaler proxy versions 3.6.1.25 and prior. This...

BlueTeam.Lab

BlueTeam.Lab Purpose This project contains a set of Terraform and Ansible scripts to create an orchestrated BlueTeam Lab. The goal of this project is to provide the red and blue teams with the ability to deploy an ad-hoc detection lab to test various attacks and forensic artifacts on the latest...

ironcurtain

IronCurtain A secure runtime for autonomous AI agents, where security policy is derived from a human-readable constitution. When someone writes "secure," you should immediately be skeptical.What do we mean by secure? !WARNING Research Prototype. IronCurtain is an early-stage research project...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

CVE-2023-36845

CVE-2023-36845 Description CVE-2023-36845 represents a notable PHP environment variable manipulation vulnerability that impacts Juniper SRX firewalls and EX switches. While Juniper has categorized this vulnerability as being of medium severity, in this article, we will elucidate how this singular...

zoneminder-snapshots-rce-poc

Zoneminder Unauthenticated RCE via Snapshots CVE-2023-26035 POC This is a script written in Python that allows the exploitation of the Zoneminder's security flaw described in CVE-2023-26035. The system is vulnerable in versions preceding 1.36.33 and 1.37.33. Usage Clone the repository to your...

CVE-2022-46169_poc

CVE-2022-46169 unauthenticated remote code execution Description Authentication Bypass: a hostname-based authorization check is not implemented safely for most installations of Cacti Command Injection: unsanitized user input is propagated to a string used to execute an external command Demo POC...

chaos-mesh

Chaos Mesh is an open source, cloud-native Chaos Engineering platform for Kubernetes. It uses Kubernetes custom resources to define, orchestrate, and observe controlled fault injection against workloads, infrastructure, cloud services, and applications. Chaos Mesh is a Cloud Native Comp...

CVE-2023-23488-pmpro-2.8

Dockerizing a Vulnerability: CVE-2023-23488 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Paid Memberships Pro v2.9.8 WordPress Plugin -...

glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

GL.iNet Beryl AX Triple RCE PoC PoC for three unauthenticated command injection vulnerabilities CVE-2026-11450, CVE-2026-11451, CVE-2026-11452 in the GL.iNet GL-MT3000 Beryl AX travel router firmware = 4.4.5. Full writeup:...

howdy

Howdy provides Windows Hello™ style authentication for Linux. Use your built-in IR emitters and camera in combination with facial recognition to prove who you are. Using the central authentication system PAM, this works everywhere you would otherwise need your password: Login, lock screen, sudo,...

CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

CVE-2018-5767-AC9

CVE-2018-5767-AC9 An implementation of a proof-of-concept for CVE-2018-5767 https://vulners.com/cve/CVE-2018-5767 The following is an actualization of CVE-2018-5767, a vulnerability which exploits an unguarded call to sscanf that occurs when parsing the 'Cookie' header for a password. The...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF leading to RCE This bug allows a remote website to create and start an arbitrary docker container on machines running Che before versions 7.3.0 and 7.4.1 when a user visits a webpage. Vulnerability This is a CSRF bug that allows a remote website to create and start...

kong

Kong: The Agentic Reverse Engineer LLM orchestration for reverse engineering binaries What is Kong? Most tasks follow a linear relationship: the more difficult a task, the longer it usually takes. Reverse engineering and binary analysis is a task in which the actual difficulty is somewhat trivial...