faxhell

faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...

CVE-2026-20071

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier is vulnerable in its OAuth authorization endpoint , which reads the oauth_callback URL from the user-submitted form instead of the server-side stored request token. This allows an attacker to hijack the OAuth flow and obtain an access ...

EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

ImpulsiveDLLHijack

ImpulsiveDLLHijack C based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach : The tool basically acts on automating following...

hijackthis

下载 最新构建版本 v3.x - 发布版 稳定版构建 v2 已过时 - 不再更新 （此为测试版 - 主要变更正在进行中；不过完全可安全使用） HiJackThis+ HiJackThis+ Plus （之前称为：HiJackThis Fork v3）是原始 Trend Micro HiJackThis by Merijn Bellekom 开发的一个分支和延续，后者曾是众所周知的一款工具。 目前，它是对原始引擎进行逐步100%重写的代码，旨在提供与最新 Windows 操作系统的完全兼容性，并在快速生成日志文件结果与对抗最流行恶意软件（包括其他杀毒软件未知的恶意软件）之间取得平衡。 它由...

CVE-2026-8206

CVE-2026-8206 - Exploit Masivo del Plugin Kirki de WordPress Herramienta de explotación masiva para CVE-2026-8206 – una vulnerabilidad crítica en el plugin Kirki de WordPress versiones ≤ 6.0.6 que permite a atacantes no autenticados secuestrar enlaces de restablecimiento de contraseña y tomar el...

Digital-Signature-Hijack

Digital Signature Hijack Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a...

CVE-2020-12432

CVE-2020-12432 Collabora CODE = 4.2.2 - XSS almacenado y permisos inseguros en la API WOPI de Vereign secuestro de cuenta - 4.2.2 Versiones afectadas: Collabora CODE = 4.2.2 Requisitos de explotación: La interfaz de la API /wopi/ de Vereign debe ser accesible utilizando el token generado...

Simplog-Exploit

Simplog-Exploit Este repositorio contiene la configuración, el exploit y el parche para la vulnerabilidad CSRF CVE-2009-4092 en Simplog. La vulnerabilidad existe en el archivo user.php de Simplog 0.9.3.2, una aplicación web utilizada para proporcionar a las personas una forma sencilla de crear y...

c0ntextomy

c0ntextomy una falacia informal y un tipo de atribución falsa en la que se extrae un pasaje de su contexto circundante de manera que se distorsiona su significado previsto Wikipedia - Contextomy Una Prueba de Concepto que demuestra la vulnerabilidad con un secuestro de sesión de depuración,...

tabi

Advanced example This example demonstrates how to use the tabi module in order to detect all possible BGP hijacks seen from a BGP collector. Requirements WARNING : Before trying this example make sure you have at least 2GB of free memory on your computer The installation procedure is described in...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

PyPsPipeJack

PyPsPipeJack Esta herramienta es la continuación de mi otra herramienta, OpenPsPipeJack. Esta versión está basada en Python y funciona en Linux utilizando principalmente Impacket. En resumen, si tienes administrador local en un host remoto, puedes conectarte a sesiones remotas de PowerShell en es...

CVE-2024-0197-POC

CVE-2024-0197-POC Prueba de concepto para la escalada de privilegios locales en Thales Sentinel HASP LDK. Inicialmente quería desarrollar una, pero al final resultó innecesario. No hay una condición de carrera que ganar, y un simple secuestro del orden de búsqueda de DLL desde una ubicación...