2520454 matches found
CGIShell
CGIShell shellshock CVE-2014-6271 CGI Exploit Use like OpenSSH via CGI Page Use python cgishell.py 'http://www.google.com/cve-2014-6271/poc.cgi' Screenshot Dependence Windows needed pyreadline It is not needed chardet Future Add TestCase HTTP Login Support http transmission gzip compression chard...
CVE-2022-0847-Container-Escape
CVE-2022-0847 CVE-2022-0847 used to achieve container escape overwrite any read-only files on host Slides in Chinese available here 利用CVE-2022-0847 Dirty Pipe 实现容器逃逸（效果为覆写宿主机上任意只读文件） 中文汇报PPT在这里 Introduction If the kernel is vulnerable to CVE-2022-0847, the attacker can overwrite read-only files...
CVE-2025-15521
CVE-2025-15521 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. root@kitploit: | | | | || | | | || | | | | | | | --| | | || | | | | ||| || | | || |...
Microsoft-Windows-SMBGhost-Vulnerability-Checker---CVE-2020-0796---SMBv3-RCE
Microsoft Windows SMBGhost Vulnerability Checker - CVE-2020-0796 - SMBv3-RCE The scanner is for meant only for testing whether a server is vulnerable. It is not meant for research or development, hence the fixed payload. It checks for SMB dialect 3.1.1 and compression capability through a negotia...
LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320
🧠 LetsDefend SharePoint Zero-Day Analysis ToolShell - SOC342-CVE-2025-53770 📘 Introduction I investigated a SharePoint zero-day called ToolShell CVE-2025-53770 in the LetsDefend cyber lab. The exercise mimicked a real-world zero-day RCE attack where a malicious POST request bypassed authenticatio...
CVE-2022-36446-Webmin-Software-Package-Updates-RCE
A Python script to exploit CVE-2022-36446 Software Package Updates RCE Authenticated on Webmin 1.997. Features Supports HTTP and HTTPS even with self-signed certificates with --insecure. Single command execution with --command option. Interactive console with --interactive option...
cve-2020-28653-poc
Manage Engine OpManager CVE-2020-28653 Proof of Concept This proof of concept detects whether a Manage Engine OpManager instance is vulnerable to CVE-2020-28653. Detection is performed by firing off a request containing the serialized payload to the instance. Upon the payload being deserialized, ...
PrintNotifyPotato
PrintNotifyPotato PrintNotifyPotato Another potato, using PrintNotify COM service for lifting rights For Windows 10 - 11 Windows Server 2012 - 2022 Usege root@kitploit: C:\Windows\Temp PrintNotifyPotato.exe aaaa aaa aaa aaaa aaa aaa aaaa aaa aaa aaaa aaa aaa aaaa aaa aaa aaaa aaa aaa aaaa aaa...
Advanced-SQL-Injection-Cheatsheet
Hoja de referencia de inyección SQL basada en errores de MySQL Esta es probablemente la vulnerabilidad más fácil dentro del ataque de inyección SQL. Un atacante puede enumerar y volcar la base de datos MySQL utilizando los mensajes de error de SQL a su favor. Detección de la...
CVE-H3C-Report
H3C GR series router system management has unauthorized access vulnerability Product : GR series router version : all rating : high-risk website : http://www.h3c.com/ Hazards : Attackers can exploit this vulnerability to obtain sensitive information from routers by constructing special request...
CVE-2023-20209
I started looking at Cisco Expressway after I noticed quite a few of them on the internet during Red Team engagements, but never had the time during work to explore the product further. Initially I was looking for an auth bypass to chain into RCE but ran out of time and settled on a post auth RCE...
CVE-2019-19781
CVE-2019-19781 Automated script for Citrix ADC scanner CVE-2019-19781 using hosts retrieved from Shodan API. You must have a Shodan account to use this script. Click here if you don't have Shodan account. Installation 1. Install dependencies. root@kitploit: CentOS & Fedora yum install git python3...
flareprox
FlareProx 🔥 Simple IP Rotation & URL Redirection via Cloudflare Workers FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods GET, POST, PUT, DELETE, etc. and provides IP masking through...
CVE-2024-2879
CVE-2024-2879 Description LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2022-26809
CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...
Shockwave-OSS
BountyTricks Sharing Bug Bounty tips and tricks with the community including but not limited to automation, one liners and useful thoughts Cyllabus 💂♂️ Misc Regex Validator Homograph Generator Shodan-Scripts HTTP Headers MIME Types Reverse-Proxies Writeups HTTP Request Smuggling Github local recon...
droidlysis
DroidLysis DroidLysis 是一个 Android 应用预分析工具 ：它执行我们在逆向工程开始时通常做的重复且枯燥的任务。它对 Android 样本进行反汇编，将输出组织到目录中，并搜索代码中可疑的关注点。输出有助于逆向工程师加快分析的前几步。 DroidLysis 可用于 Android 包（apk）、Dalvik 可执行文件（dex）、Zip 文件（zip）、Rar 文件（rar）或文件目录。 安装 DroidLysis 1. 安装必要的系统包 root@kitploit: sudo apt-get install default-jre git python3...
reproxy
Reproxy 是一个简单的边缘 HTTPs 服务器/反向代理，支持多种提供者（docker、static、file、consul catalog）。一个或多个提供者提供关于请求服务器、请求 URL、目标 URL 和健康检查 URL 的信息。它以单个二进制文件或 Docker 容器的形式分发。 通过 Let's Encrypt 自动 SSL 终止 支持用户提供的 SSL 证书 简单但灵活的代理规则 静态、命令行代理规则提供者 动态、基于文件的代理规则提供者 Docker 提供者，自动发现 Consul Catalog 提供者，通过服务标签发现 支持多个（虚拟）主机 可选流量压缩 可选基于...
saas_enum
SaaS Enum SaaS Enum is a command line tool for discovering the SaaS platforms a company may be using. The tool looks for DNS entries that match known provider patterns and optionally performs lightweight web checks for confirmation. Installation root@kitploit: pip install -r requirements.txt Usag...