CVE-2019-0708-generate-hosts

CVE-2019-0708-generate-hosts Questo programma utilizza nmap per analizzare gli indirizzi CIDR elencati nel file 3389cidrs uno per riga, generando il file 3389hosts che contiene gli indirizzi IP delle macchine Windows che potrebbero avere il desktop remoto 3389 abilitato, riducendo notevolmente il...

CVE-2026-74932

WP Fastest Cache (WordPress plugin) versions before 1.5.1 fail to validate the Host header before using it to build URLs for asset files embedded in cached pages, and omit that header from the cache key. This allows an unauthenticated attacker to poison cached pages with references to an attacker...

gobuster

Gobuster 💻 Introduzione Uno strumento di brute-forcing veloce e flessibile scritto in Go Gobuster è uno strumento di brute-forcing per directory/file, DNS e virtual host ad alte prestazioni, scritto in Go. È progettato per essere veloce, affidabile e facile da usare per professionisti della...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection

CVE-2026-26898: Xiaomi Mi Router 4A Gigabit - SSRF tramite Host Header Injection -orange Riepilogo Una vulnerabilità di Server-Side Request Forgery SSRF esiste nello Xiaomi Mi Router 4A Gigabit Edition. L'interfaccia web del router non convalida l'header HTTP Host, consentendo a un attaccante non...

XSSTracer

XSSTracer v1.3 von 1N3 @CrowdShield https://crowdshield.com XSSTracer ist ein kleines Python-Skript, das entfernte Webserver auf Clickjacking, Cross-Frame-Scripting, Cross-Site-Tracing und Host-Header-Injection überprüft. root@kitploit: Usage: ./xsstracer...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

sticky_keys_hunter

Sticky Keys Hunter This POC bash script tests for sticky keys and utilman backdoors. The script will connect to an RDP server, send both the sticky keys and utilman triggers and screenshot the result. This script was written to prove a theory I had about detecting these backdoors in a blackbox...

CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-55637

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2 , the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default address 127.0.0.1:8080 when MCP_AUTH_TOKEN is unset, without validating Host or Origin headers. A malicious websit...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Fehlende Autorisierung an Docker-Plugin-Endpunkten → Host-RCE Proof-of-concept für CVE-2026-44848 , eine Schwachstelle mit fehlender Authentifizierung CWE-862 in Portainer, die es einem Nicht-Admin -Benutzer mit Docker-Endpunktzugriff ermöglicht, privilegierte...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

vbox_cve_2017_10235

CVE-2017-10235: Pufferüberlauf im VirtualBox E1000-Gerät Einleitung Das folgende Dokument beschreibt einen Fehler in VirtualBox v5.1.22 behoben in v5.1.24 in der Gastgeräte-Emulationskomponente DevE1000 Intel 82540EM Ethernet Controller Emulation, in der Funktion e1kFallbackAddToFrame, der zu ein...

urlbuster

root@kitploit: ██╗ ██╗██████╗ ██╗ ██████╗ ██╗ ██╗███████╗████████╗███████╗██████╗ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██║ ██║██████╔╝██║ ██████╔╝██║ ██║███████╗ ██║ █████╗ ██████╔╝ ██║ ██║██╔══██╗██║ ██╔══██╗██║ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ╚██████╔╝██║...

eavesarp

Eavesarp Uno strumento di ricognizione che analizza le richieste ARP per identificare gli host che probabilmente comunicano tra loro, utile in quelle temute situazioni in cui LLMNR/NBNS non sono in uso per la risoluzione dei nomi. Presentato da: Requisiti/Installazione Funziona solo su Kali o alt...

CVE-2018-13257

Blackboard Learn CAS-Ticket Host-Header-Spoofing Ein Authentifizierungsmodul in Blackboard Learn ist anfällig für HTTP-Host-Header-Spoofing während der Validierung von Service-Tickets des Central Authentication Service CAS. Ein CAS-Service-Ticket ist nur für einen bestimmten Service vorgesehen,...

PowerSharpPack

Sponsorizzato da PowerSharpPack Molti progetti C offensivi utili sono stati racchiusi in PowerShell per un facile utilizzo. Perché? A mio parere personale, PowerShell offensivo non è morto a causa di AMSI, Script-block-logging, Constrained Language Mode o altre funzionalità di protezione. Ognuno ...

CVE-2011-3192

CVE-2011-3192 Führen Sie es mit Python 3.7 oder 3.10 aus getestet damit 1. git clone https://github.com/futurezayka/CVE-2011-3192.git 2. cd ./CVE-2011-3192 3. pip install -r requirements.txt 4. python3 exploit.py host tasks example python3 exploit.py https://example.com 50...

SourceWolf

SourceWolf ​ Getestete Umgebungen: Windows, MAC, Linux und Windows-Subsystem für Linux WSL Sponsoren Unterstützen Sie dieses Projekt, indem Sie ein Sponsor werden. Schauen Sie sich diese großartigen Sponsoren an: Oxylabs bietet Premium-Proxies mit über 100 Mio. IPs in 195 Ländern und einsatzberei...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...