Panoptic

Panoptic Panoptic 是一款开源渗透测试工具，可通过路径遍历漏洞自动搜索并获取常见的日志和配置文件。 功能特性 异步并发扫描，支持可配置的工作线程池 （--concurrency） 通过基于参数、基于路径、POST、Cookie、请求头和 JSON 请求体注入，自动发现常见的日志和配置文件 FUZZ 标记用于任意注入点——将 FUZZ 放在任意 --header 或 --data 值中 为解码文件路径的端点提供 Base64 编码 （--base64） 自动检测操作系统，并可选择限制后续扫描 启发式响应比较，配合状态码过滤以 减少误报 动态用例注入——解析...

CVE-2024-24919

Checkpoint POC Exploit（用于测试目的），用于从 Checkpoint 设备中检索敏感文件，基于以下文章：https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ 我对本脚本的任何滥用行为概不负责，其目的是让防御者测试自己的设备。...

SMBCrunch

SMBCrunch 作为红队成员，最耗时的任务之一就是深入文件系统和共享，试图识别任何潜在的敏感信息。SMBCrunch 让红队成员能够快速发现网络中的 Windows 文件共享，对提供的共享执行递归目录列表，甚至可以在远程共享中发现看似有价值的目标时抓取文件。 有三个 3 不同的工具协同工作。请阅读以下三个部分，了解它们是如何协同工作的。 SMBHunt 给定一个文件（或 gnmap 文件），SMBHunt 会查找与提供的服务器关联的所有 Windows 文件共享（如果提供了 gnmap 文件，则只查看端口 445 开放的服务器）。如果未提供执行检查的凭据，它将检查空会话共享。...

XXEinjector

XXEinjector XXEinjector 自动化使用直接和带外方法检索文件。目录列表仅适用于 Java 应用程序。其他应用程序需要使用暴力破解方法。 Options: root@kitploit: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file Mandatory - file containing valid HTTP request with xml. You can also mark with "XXEINJECT" a point where DTD...

ExploitWebmin

Script Webmin Proyecto creado por: Gabriel Jose. Script en Python para explotar la vulnerabilidad de Webmin cve-2006-3392 Ejemplo de uso ./exploitWebmin.py -pt http -t host -p port -f file root@kitploit: ./exploitWebmin.py -pt http -t 127.0.0.1 -p 10000 -f /etc/passwd...

CVE-2018-8097-PoC

CVE-2018-8097 PoC para CVE-2018-8097. Este script explota CVE-2018-8097 y puede recuperar archivos y contenidos mediante un método de ejecución remota de código RCE ciega basada en tiempo. Uso root@kitploit: python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h...

Joomla! Component Jw_allVideos - Arbitrary File Retrieval

A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos JwallVideos plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ modified dot dot in the file parameter. id: CVE-2010-0696 info: name: Joomla! Component...

WordPress Simple Job Board <2.9.4 - Local File Inclusion

WordPress Simple Job Board prior to version 2.9.4 is vulnerable to arbitrary file retrieval vulnerabilities because it does not validate the sjbfile parameter when viewing a resume, allowing an authenticated user with the downloadresume capability such as HR users to download arbitrary files from...

WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval

WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative...

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...

modsecurity-backdoor

Puerta Trasera de ModSecurity Descripción Esta es una prueba de concepto de un software malicioso que se ejecuta dentro del WAF ModSecurity. El software tiene dos funciones principales: Obtener el contenido de archivos. Ejecutar comandos y obtener su salida shell remota. Además, incluye estas...

Myesve

myesve Marco de explotación CVE-2024-38475 – Versión 1.0 Aviso legal: Esta herramienta está destinada únicamente a pruebas de seguridad autorizadas, investigación educativa y programas de bug bounty legítimos. No la utilice contra sistemas que no posea o para los que no tenga permiso explícito pa...

CVE-2024-55557

CVE-2024-55557 Uso root@kitploit: python3 exploit.py --local retrieve from local readable files python3 exploit.py default mode is remote Más Leer más sobre CVE-2024-55557 - Weasis 4.5.1 POC https://github.com/user-attachments/assets/a3f64a58-7720-4f93-8bcc-9393d8afcb68...

ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. id: CVE-2017-11512 info...

CVE-2025-60574

Descubridores de Vulnerabilidades y Autores de Exploits Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Descripción de la Vulnerabilidad Se ha identificado una vulnerabilidad de Inclusión de Archivos Locales LFI en tQuadra CMS 4.2.1117. El problema existe en la ruta "/styles/", que no...

CVE-2016-5639

CVE-2016-5639 Crestron AirMedia AM-100 路径遍历与哈希转储 Metasploit 模块 两个相似的模块，利用 CVE-2016-5639 通过路径遍历转储哈希并检索文件。我将这两个模块分开编写，因为我想获得编写能够"转储"哈希、正确格式化以用于破解，并将其添加到 loot 中的经验。欢迎任何建议。 所有原始漏洞披露与报告的功劳都应归于 Cylance，我想： https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-001.md...

CVE-2018-7422

CVE-2018-12613 由于未对用户输入进行清理导致的本地文件包含漏洞。 受影响的软件 1. WordPress 插件：Site-Editor v.1.1.1； 使用方法 此 PowerShell 脚本需要两个参数来构造一个利用 HTTP 请求： root@kitploit: 1. WordPress URL 端点 2. 要获取的远程服务器上的完整文件路径 示例 准备好所有参数以便使用该脚本： 然后文件就会被获取。 代码作者：@zc00l...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...