CVE-2025-34299-lab

CVE-2025-34299 Test Environment Docker test environment for CVE-2025-34299 - Monsta FTP Pre-Authentication Remote Code Execution vulnerability. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2025-34299 Severity| Critical CVSS 9.8 CWE| CWE-434 Unrestricted Upload of File with Dangerous Typ...

egression

Description EGRESSION is a tool that provides an instant view of how easy it is to upload sensitive data from any given network. It starts with a sensitive file with these contents, which is stored locally in plaintext. This file is used to test the egress / DLP controls on the network by...

CVE-2011-2523

CVE-2011-2523 - vsftpd 2.3.4 Exploit Description vsftpd, which stands for Very Secure FTP Daemon,is an FTP server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL. In July 2011, it was discovered that vsftpd version 2.3.4...

cve-2015-3306

cve-2015-3306 docker image hackarada/cve-2015-3306 Intended for personal use docker build -t hackarada/cve-2015-3306 docker run --rm -it -p 21:21 -p 80:80 hackarada/cve-2015-3306...

Brosec

Overview tl;dr Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to genera...

CVE-2024-28995

CVE-2024-28995 PoC SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Queries Shodan: product:"Rhinosoft Serv-U httpd" "Serv-U FTP Server" Fofa: app="SolarWinds-Serv-U-FTP" References...

cerbrutus

Cerbrutus Modular brute force tool written in Python, for very fast password spraying SSH, and FTP and in the near future other network services. COMING SOON: SMB, HTTPs POST, HTTPs GET, HTTP BASIC AUTH Thanks to @0dayctf, Rondons, Enigma, and 001 for testing and contributing Installation: cd /op...

CVE-2018-7449

CVE-2018-7449 1. Introduction My tool is written in Python and exploits the CVE-2018-7449 vulnerability to execute a series of commands that will crash the ftp daemon. DISCLAIMER!!! Please note that the use of hacking tools without authorization is illegal and could result in legal problems...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

CVE-2025-47812

CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise 📘 Introduction: Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful...

SharpFtpC2

SharpFtpC2 PoC SharpFtpC2 is a small, experimental project aimed at exploring the possibility of using FTPS for relaying commands and responses between two remote computers. It employs the FTP protocol as a makeshift tunnel through which the computers, both acting as clients connected to an FTP...

WingFTP-CVE-2025-47812-illdeed

CVE-2025-47812 - Wing FTP Server RCE Exploit This repository provides a proof-of-concept exploit for CVE-2025-47812 , a remote command execution RCE vulnerability in Wing FTP Server. An attacker can inject and execute arbitrary Lua-based system commands by abusing the username parameter during...

xcavator

xcavator A network data locater using credentials obtained during penetration tests. Xcavator is a tool that scans a range of IP addresses for services that host files FTP, FTPS and SMB at the moment and for given credentials it will try to download everything it can and scan within the files for...

CVE-2024-4040

CVE-2024-4040 Introduction Recently, I came across this vulnerability and found it quite interesting. I read the following articles and wrote a brief exploit. https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/...

CVE-2023-49367

CVE-2023-49367 - Sensetive Data Exposure Sensetive Data Exposure in Kyocera Printer Web Panel Vendor: Kyocera Corporation Affected Versions: Command Center RX - EXOSYS M5521cdn Description After connecting to the Kyocera interface address book, test requests for smb and ftp can be seen in the sen...

striptls

striptls - auditing proxy poc implementation of STARTTLS stripping attacks A generic tcp proxy implementation and audit tool to perform protocol independent ssl/tls interception and STARTTLS stripping attacks on SMTP, POP3, IMAP, FTP, NNTP, XMPP, ACAP and IRC. Python2! 🏆 Trophies CVE-2016-0772 -...

CVE-2019-19383

CVE-2019-19383 FreeFTPd 1.0.8 Post-Authentication Buffer Overflow via "SIZE" command. This exploit is published as-is for raising security awareness in the public interest, and educational purposes. Do not use this code for criminal activity...

CVE-2025-47812

CVE-2025-47812 How does this detection method work? This Nuclei template detects Wing FTP Server instances vulnerable to CVE-2025-47812 by identifying versions older than 7.4.4 exposed in the web client’s HTML response. How do I run this script? 1. Download Nuclei from here 2. Copy the template t...

Modified-CVE-2015-3306-Exploit

Modified-CVE-2015-3306-Exploit How to 1. Create a php reverse shell 2. Start server to host shell in the same directory python3 -m http.server 3. Start netcat listener on local port of choice example: nc -nlvp port of choice 4. Run exploit example provided below python3 modifiedCVE20153306.py...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...