Global-Protect_VPN_Vuln

CVE-2024-3400 This program was improved upon to include a safety-feature which will catch the cases that will cause this script to be caught in from excuting indefinitely. The base script was created by retkoussa and referenced here. Problem with the previous script:- The script fails if the...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigating a PAN-OS CVE-2024-3400 Command Injection Attempt Overview This project documents the investigation of a CVE-2024-3400 command injection attempt targeting a PAN-OS GlobalProtect service. The goal was to determine: whether this is a real attack whether command execution occurred wheth...

CVE-2026-0257

CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass Vulnerability ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone...

panrapidcheck

PAN Rapid Check Simpleyou should probably just do this in bash with grep PANOS support file checker that extracts some places to look for CVE-2024-3400 IoCs Generate the support file from Device - Support - Generate Tech Support file iocs.txt should include IPs/hosts from known bad for example...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection Vendor Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

NachoVPN

NachoVPN 🌮🔒 NachoVPN is a Proof of Concept that demonstrates exploitation of SSL-VPN clients, using a rogue VPN server. It uses a plugin-based architecture so that support for additional SSL-VPN products can be contributed by the community. It currently supports various popular corporate VPN...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect The Pan-OS Checker is to determine the Palo Alto PAN-OS software version of a remote GlobalProtect portal or management interface. Before run the script, need to make sure version-table.txt in the same...

CVE-2024-3400-RCE-Scan

Cyberspace Mapping Dork Fofa app="paloalto-GlobalProtect" https://en.fofa.info/result?qbase64=YXBwPSJwYWxvYWx0by1HbG9iYWxQcm90ZWN0Ig%3D%3D Zoomeye app:"Palo Alto Networks firewall httpd"...

CVE-2025-0133

CVE-2025-0133 Vulnerability Scanner A Bash-based automated scanner tool for detecting the CVE-2025-0133 Reflected XSS vulnerability in Palo Alto GlobalProtect Gateway & Portal using nuclei and shodanx. Author : Date : 2025-06-23 Severity : Medium CVE ID : CVE-2025-0133 Vulnerability Type :...

cve-2025-0133

CVE-2025-0133 Reflected XSS Detection Tool Author : Derek Odiorne Date : 2025-05-23 Severity : Medium Tested Against : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Summary This script performs safe, authorized testing for the vulnerability CVE-2025-0133 , a reflected Cross-Site Scripting XSS...

cve-2025-0133

CVE-2025-0133 Scanner Palo Alto PAN-OS GlobalProtect Reflected XSS vulnerability scanner. Features Single target & mass scanning Multi-threaded configurable Proxy support Burp, ZAP, etc. Colored output with summary Save vulnerable URLs to file Installation Via pip from GitHub pip install...

GlobalUnProtect

GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows client installations. Blog post: https://rotarydrone.medium.com/4a1d8fc7773e Usage Run as standalone or in-memory via execute-assembly or equivalent. Collects all contents to an...

letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs, exploit patterns, and mitigation guidance. CVE-2024-3400 Incident Investigation 🔍 Overview This repository...

CVE-2026-0257

🚨 CVE-2026-0257 - Authentication Bypass Vulnerabilities PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Authentication Bypass in GlobalProtect Portal & Gateway 📌 Overview CVE-2026-0257 is an authentication bypass vulnerability affecting the GlobalProtect portal and gateway components ...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild Overview CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interface...

CVE-2024-3400-Check

Description 1. Perform a POST request to the /ssl-vpn/hipreport.esp endpoint. 2. Perform a GET request to /global-protect/portal/images/sxy.txt to check if the exploitation allows access to the file, which would typically be forbidden 403 Forbidden status. Prerequisites You need Python 3.6 or new...

Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting

Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting. id: CVE-2018-10141 info: name: Palo Alto Networks PAN-OS GlobalProtect 8.1.4 - Cross-Site Scripting autho...

CVE-2024-3400

PAN-OS Firewall Exploit Script This script is designed to demonstrate the exploitation of vulnerabilities in PAN-OS firewalls. It sends a specially crafted payload to the firewall's API endpoint to execute arbitrary commands. This exploit specifically targets CVE-2024-3400, a command injection...