1179 matches found
PyFlooder
PyFlooder Un script de Python para HTTP Flood que podría tumbar un sitio web normal en 10 segundos ¿Cómo funciona? Genera un número configurable de solicitudes GET aleatorias y las envía al objetivo Uso root@kitploit: pyflooder.py...
MalleableC2Profiles
MalleableC2Profiles Perfiles Malleable C2 para Cobalt Strike versión 3.6+ bingsearchgetonly.profile - Perfil de búsqueda web de Bing, solo usa solicitudes GET cnnvideogetonly.profile - Perfil de transmisión de video en vivo de MSNBC, solo usa solicitudes GET googledrivegetonly.profile - Perfil...
log4j-scan
1 Usage Instructions CVE-2021-44228 log4j 2.x rce vulnerability detection tool, sends GET requests to the target URL and uses DNSlog to check for responses. root@kitploit: $ python3 log4j-scan.py -h Usage: python log4j-scan.py -u Options: -h, --help show this help message and exit -u URL, --url=U...
SQLi_Sleeps
SQLiSleeps Es un script sencillo que permite encontrar vulnerabilidades SQLi, obteniendo un tiempo de respuesta superior a 20 segundos mediante inyección basada en tiempo. root@kitploit: usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes...
http-protocol-exfil
http-protocol-exfil Usa la versión del protocolo HTTP para enviar un archivo bit a bit "HTTP/1.0" es un 0 y "HTTP/1.1" es un 1. Utiliza peticiones GET, por lo que el Blue Team solo vería las solicitudes a tu dirección IP. Sin embargo, se necesita mucho tiempo para enviar archivos grandes; por...
extended-xss-search
Buscador y Finder de XSS Extendido Esta es la versión extendida basada en la idea inicial ya publicada como "xssfinder". Esta versión privada permite a un atacante realizar no solo solicitudes GET sino también POST. Además, es posible proxy cada solicitud a través de Burp u otro túnel. Primeros...
HttpStrike
HttpStrike Un script DDoS rápido escrito en Python; enviará una gran cantidad de solicitudes GET si aumentas las solicitudes como prefieras...
CVE-2026-33340
CVE-2026-33340: SSRF en lollms-webui Descripción general Campo| Detalle ---|--- ID CVE| CVE-2026-33340 Vulnerabilidad| Falsificación de solicitudes del lado del servidor Server-Side Request Forgery, SSRF Producto afectado| ParisNeo/lollms-webui LoLLMS WEBUI Gravedad| Crítica — CVSS 9.1 Vector CVS...
CVE-2026-86718
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...
CVE-2026-53760
Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
Astra Linux – Vulnerability in Batik
Apache Batik 1.13 is vulnerable to server-side request forgery, which is caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...
Astra Linux – Vulnerability in ffmpeg, ffmpeg5
A flaw was discovered in FFmpeg’s DASH playlist support. This vulnerability allows for arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg, through a crafted DASH playlist containing malicious URLs...
EUVD-2026-61007
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...
EUVD-2026-55994
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...
CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...
CVE-2025-13394
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...
CVE-2026-34966
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
EUVD-2026-52866
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...