nightHawkResponse

nightHawk Response Custom built application for asynchronus forensic data presentation on an Elasticsearch backend. This application is designed to ingest a Mandiant Redline "collections" file and give flexibility in search/stack and tagging. The application was born out of the inability to contr...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Example Scenario You have identified a Zabbix server running on IP 192.168.1.100, and you have access to a low-privileged user with the following details: Session ID sid: d82bf6715e1d3c1f25 Host ID hosti...

CVE-2024-22120-RCE-with-gopher

用法 root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 示例场景 你已经发现一个运行在 IP 192.168.1.100 上的 Zabbix 服务器，并且拥有一个低权限用户的访问权限，详情如下： 会话 ID（sid）：d82bf6715e1d3c1f25 主机 ID（hostid）：10107 PHP 会话 ID（phpsessid）：a4g7f48d9j3r7h8s9g 你想使用此脚本利用该 RCE 漏洞。 运行脚本 root@kitploit: python...

gopher47

gopher47 适用于 Havoc 框架的第三方 Gopher 刺客 就像电子游戏一样 :D 这是什么？🤔 这是用 Golang 为 Havoc C2 编写的第三方 agent，主要作为一个学习项目来写，但我相信它仍然有用。 等这篇文章发布时，你可以在我的博客上了解更多关于这是什么以及为什么这么做的内容：这里 欢迎贡献！ 我不打算更新得太频繁，但如果我做得开心，未来可能会加更多东西。 命令 Command| Description| Example ---|---|--- checkin| 返回基本系统信息| checkin shell| 运行命令（通过 Go 的 os/exec 执行...

Gopherus

Gopherus 如果你知道某个存在 SSRF 漏洞的地方，那么这个工具将帮助你生成 Gopher 载荷，用于利用 SSRF（服务器端请求伪造）并获得 RCE（远程代码执行）。同时，它还能帮助你在目标服务器上获取反弹 Shell。更多 信息可以查看相关博客：Gopherus 博客 关于 该工具可以为以下目标生成载荷： 1. MySQL Port-3306 2. PostgreSQLPort-5432 3. FastCGI Port-9000 4. Memcached Port-11211 如果存储的数据被以下语言反序列化： Python Ruby PHP 5. Redis Port-63...

Astra Linux – Vulnerability in Squid

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, a Denial of Service can occur when processing long Gopher server responses due to improper buffer management...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web that supports HTTP, HTTPS, FTP, and other protocols. Due to a NULL pointer dereference bug, Squid is vulnerable to Denial of Service attacks targeting its Gopher gateway. The Gopher protocol was always available and enabled in Squid prior to Squid 6.0.1...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

CVE-2026-49345

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery SSRF vulnerability exists in Mercator's CVE configuration panel /admin/config/parameters. The testProvider method in ConfigurationController passes...

CVE-2026-49345 Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery SSRF vulnerability exists in Mercator's CVE configuration panel /admin/config/parameters. The testProvider method in ConfigurationController passes...

CVE-2026-49345

CVE-2026-49345 affects Mercator before 2025.05.19. The SSRF flaw resides in the CVE configuration panel (/admin/config/parameters) where ConfigurationController.testProvider() passes user input directly to curl_init() without validating scheme/host/IP. An authenticated user with configure permiss...

JLSEC-2026-398

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request HTTP...

Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the volume" "Create assets in the volume" Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no...

GHSA-3M9M-24VH-39WX Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the volume" "Create assets in the volume" Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no...

CVE-2026-35187

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated...

CVE-2026-35187

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated...

CVE-2026-35187

CVE-2026-35187 affects pyload/pyload-ng prior to 0.5.0b3.dev97, where parse_urls(...) calls get_url(url) without URL validation, protocol restriction, or IP blacklist. This enables Server-Side Request Forgery (SSRF) via crafted URLs and multi‑protocol support (http/https, file://, gopher://, dict...

CVE-2026-35187

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated...