AdPush < 1.44 - Cross-Site Scripting

The adsense-plugin aka Google AdSense plugin before 1.44 for WordPress has multiple XSS issues. id: CVE-2017-18487 info: name: AdPush 1.44 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The adsense-plugin aka Google AdSense plugin before 1.44 for WordPress has multip...

WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting

WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. id: CVE-2017-18536 info: name: WordPress Stop User Enumeration =1.3.7 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress Stop User Enumeration 1.3.7 an...

Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. id: CVE-2017-18494 info: name: Custom Search by BestWebSoft 1.36 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The custom-search-plugin plugin before 1.36 for WordPress has multiple X...

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php. id: CVE-2018-19136 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting v...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...

CVE-2020-10199

CVE-2020-10199 Version de retour d'echo, bug non testé écrit à la hâte. root@kitploit: Usage: python http://127.0.0.1:8080 username password 参考：https://www.cnblogs.com/magic-zero/p/12641068.html...

hyenae-ng

Hyenae NG Hyenae NG Next Generation is a re-write of the original Hyenae tool which was originally published back in the year 2010. Besides switching from C to C++, using modern design concepts, Hyenae NG was just like the original Hyenae written with maximum portability in mind. Since the origin...

Androspy

Androspy Androspy : est un Crypteur & Créateur de Backdoor avec Empoisonneur IP Automatique codé par Belahsan Ouerghi Dépendances keytool jarsigner Apache2 Metasploit-Framework xterm Installation root@kitploit: sudo apt-get install git git clone https://github.com/TunisianEagles/Androspy.git cd...

Pyramid

Pyramid Qu'est-ce que c'est Pyramid est composé de : 1. un serveur HTTP/S Python pouvant délivrer des fichiers chiffrés chacha, xor 2. des modules Python pouvant charger en mémoire les dépendances d'outils offensifs tels que Bloodhound-py, secretsdump, LaZagne, Pythonnet, DonPAPI,...

pentesting-multitool

Pentesting-Multitool Introduction Pentesting-Multitool project arises from the need to gather some pentesting tools into one tool. It will be developed using Python3 adding some external libraries as DNSPython, pythonwhois or scapy. The main functions of the script is to collect information about...

dontgo403

dontgo403은 40X 오류를 우회하는 도구입니다. 설치 최신 릴리즈를 운영체제에 맞게 RELEASES에서 받으세요 현재 구식입니다 또는 직접 컴파일하세요 권장: root@kitploit: git clone https://github.com/devploit/dontgo403; cd dontgo403; go get; go build 사용자 정의 새로운 우회 방법을 편집하거나 추가하려면 payloads 폴더의 해당 파일에 직접 추가하면 도구가 이를 사용합니다. 옵션 root@kitploit: ./dontgo403 -h...

CVE-2023-36899

CVE-2023-36899 Среда воспроизведения и инструменты для уязвимости CVE-2023-36899, связанной с обходом аутентификации сеанса без cookie cookieless в ASP.NET Framework. Cookieless DuoDrop: обход аутентификации IIS и повышение привилегий пула приложений в ASP.NET Framework CVE-2023-36899 В современн...

thedorkbox

thedorkbox TheDorkbox Collection complète de Google Dorks & techniques OSINT pour trouver des données confidentielles Bienvenue dans thedorkbox 👋 Il s'agit d'un outil OSINT qui regroupe différents Google dorks intégrés dans un modèle HTML afin que les utilisateurs non techniques comprennent...

interrogate

Interrogate Interrogate — это инструмент-концепт для выявления криптографических ключей в бинарном материале независимо от целевой операционной системы, в первую очередь для анализа дампов памяти и криминалистического использования. Способен идентифицировать ключи AES, Serpent, Twofish и...

spring4shell-exploit-poc

Spring4Shell Exploit POC Эксплойт для уязвимого Spring-приложения, использующий уязвимость Spring4Shell. Подробнее о Spring4Shell читайте в нашем блоге. Использование Требования: Docker и docker-compose root@kitploit: $ ./exploit.sh Уязвимое Spring-приложение Уязвимое Spring-приложение содержит...

yolo-cage

yolo-cage : agents de codage autonomes qui ne font aucun mal Vous êtes un ingénieur responsable. Vous ne laisseriez jamais une IA piétiner vos systèmes et codebases les plus sensibles. C'est pourquoi vous ne désactiveriez jamais les protections d'un outil comme Claude Code. Il demande la permissi...

CVE-2024-28995

CVE-2024-28995 Parcours de chemin automatisé et lecture de fichier local Fonctionnalités Détection de version : Récupère la version de Serv-U à partir de l'en-tête du serveur. Vérification de vulnérabilité : Compare la version détectée avec une version vulnérable connue 15.4.2 ou inférieure. Test...

malboxes

= Malboxes :toc: preamble :toclevels: 2 :twob: https://twitter.com/obilodeau :twhg: https://twitter.com/hugospns // github stuff ifdef::env-github:github: ifndef::github // local logo image::docs/logos/main.svgMalboxes Logo endif:: ifdef::github // logo on github...