usn_analytics

USN Analytics Build root@kitploit: git clone https://github.com/4n6ist/usnanalytics.git Linux root@kitploit: sudo dnf groupinstall development-tools // Fedora sudo dnf install glibc-static libstdc++-static // Fedora sudo apt-get install build-essential // Debian/Ubuntu cd usnanalytics make Window...

CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation

🚨 CVE-2024-32019 - Netdata ndsudo PATH Vulnerability Exploit LPE to Root A Python-based exploit for CVE-2024-32019 , a high-severity Local Privilege Escalation vulnerability in the Netdata Agent , leveraging a misconfigured SUID binary ndsudo that fails to securely handle the PATH environment...

MASTG-Hacking-Playground

MASTG Hacking Playground Welcome to the MASTG Hacking Playground which is part of the OWASP Mobile Application Security MAS project. The MASTG Hacking Playground is a collection of educational iOS and Android mobile apps, that are intentionally build insecure in order to give practical guidance t...

CVE-2021-42013-Apache-RCE-Poc-Exp

Vulnerability Name Apache Remote Code Execution CVE-2021-42013 Vulnerability Description Apache HTTP Server is an open-source web server from the Apache Software Foundation. It is fast, reliable, and extensible via a simple API. It was discovered that the fix for CVE-2021-41773 in Apache HTTP...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability in the drivers/bluetooth/btnxpuart.c module of Linux operating systems allows a hacker to cause a service failure.

The vulnerability in the drivers/bluetooth/btnxpuart.c module of Linux operating systems is related to incorrect resource management. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

frameless-bitb

Frameless BITB A new approach to Browser In The Browser BITB without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft. This POC code is built for using this new BITB with Evilginx, and a Microsoft Enterprise phishlet. Before diving deep...

awesome-oneliner-bugbounty

Awesome One-liner Bug Bounty A collection of awesome one-liner scripts especially for bug bounty. This repository stores and houses various one-liner for bug bounty tips provided by me as well as contributed by the community. Your contributions and suggestions are heartily♥ welcome. Definitions...

CVE-2019-17564

CVE-2019-17564: Apache Dubbo Deserialization Vulnerability 0x00 Introduction Apache Dubbo is a high-performance, lightweight open-source Java RPC framework. It provides three core capabilities: interface-based remote method invocation, intelligent fault tolerance and load balancing, and automatic...

CVE-2019-7216

CVE-2019-7216 In filechucker.cgi version 5.09 and filechuckerprefs.cgi version 4.99e-free-e02 there is a filter bypass, upon upload, that can lead to remote code execution providing that the user uploads a malicious file. The bypass occurs when filechucker attempts to filter out the file extensio...

Sweet-Pineapple-Builder

Sweet WiFi Pineapple Tetra Builder Sweet Pineapple Builder is a python script that automate the whole process of creating a custom WiFi Pineapple Tetra image. As the WiFi Pineapple Tetra firmware is a custom version of OpenWrt 19.07.2, it is therefore possible to create our own custom firmware...

submonitor

submonitor by xpl0ited1 Description Subdomain monitor with reporting capabilities to Slack, Discord and Telegram Usage: Configure the scanning targets on the targets.txt file, set the reporting config at the config.yaml, then create a cronjob to execute every day root@kitploit: crontab -e 0 8...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. SYSTEM ANALYSIS Identifying the Attack Surface from the Docker Environment Starting with what is running in the environment. We list all active containers: root@kitploit: docker ps Result: Container p1/lab10:latest is running, exposing 2 ports externally: Port mapping|...

ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

CVE-2020-8289

CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backblaze Summary Name: Remote Code Execution as SYSTEM/root via Backblaze CVE: CVE-2020-8289 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: Critical Discovery Date: 2020-03-13...

CVE-2015-3337

CVE-2015-3337 CVE-2015-3337 Arbitrary File Read http://10.10.20.166:9200/plugin/head/../../../../../../../../../etc/passwd Usage: python CVE-2015-3337.py root@kitploit: python CVE-2015-3337.py / \ | | | | / | |/ | | | | || || || / | / / | | | | ' / /'| |/' || | | \ / / / / / / / / | | | | | | ||...

CVE-2024-3273

CVE-2024-3273 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2024-3273, a security vulnerability discovered in D-Link NAS devices. The vulnerability allows attackers to execute arbitrary commands on vulnerable devices. Description CVE-2024-3273 is a vulnerability in...