jboss-_CVE-2017-12149

jboss-CVE-2017-12149 verifyCVE-2017-12149.jar provides a command-line mode to verify the vulnerability. If the vulnerability exists, it returns a characteristic string. Simply execute the command: root@kitploit: $ java -jar verifyCVE-2017-12149.jar http://xxx:8080 成功返回: vuln6581362514513155613jbo...

cyberpanel

🛠️ CyberPanel 由 OpenLiteSpeed 驱动的网站托管控制面板，旨在简化托管管理。 🔧 功能与服务 🔐 不同用户访问级别 （通过 ACL 实现）。 🌌 自动 SSL ，为网站提供安全保护。 💻 FTP 服务器 ，用于文件传输。 🕒 轻量级 DNS 服务器 （PowerDNS）。 🔐 phpMyAdmin ，用于管理数据库（MariaDB）。 📧 电子邮件支持 （SnappyMail）。 🕌 文件管理器 ，方便快速访问文件。 🌐 PHP 管理 ，简单易用。 🔒 防火墙 （集成 FirewallD 与 ConfigServer Firewall）。 📀 一键备份与恢复 。 ...

WindowsPatchDetector

实验性 Windows .text 段补丁检测器 ====================== 实验性：Windows .text 段比较 - 磁盘与内存 原始想法 在阅读了 Skeleton Key 恶意软件（http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/）的相关文章后，开发一个小工具，将磁盘上 .exe 和 .dll 文件中的 .text 段与它们在 RAM 中的对应部分进行比较，以检测补丁。 结果 整体上适用于 32 位和 64 位二进制文件...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

CVE-2026-56121-Feast-Unauth-RCE

CVE-2026-56121 — Feast Unauthenticated RCE via gRPC Registry Deserialization The Feast 0.63.0 registry gRPC server dill.loads the user-defined function of an OnDemandFeatureView as soon as a spec arrives — before any authorization check. The shipped config is auth: noauth, so any client that can...

proxylogscan

proxylogscan This tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin CVE-2021-26855. By chaining this bug with another post-auth arbitrary-file-write vulnerability to get code execution...

CVE-2022-41040

CVE-2022-41040 Code set relating to CVE-2022-41040. scanner.py is a Python based scanner testing for the CVE-2022-41040. Requirements The only additional modules needed to run this code is requests and colorama. root@kitploit: pip install -r requirements.txt Usage This script takes a single URL o...

CVE-2022-1388-RCE-checker-and-POC-Exploit

CVE-2022-1388 RCE checker Simple bash script to check CVE-2022-1388 RCE F5 BIG-IP. + Usage: ./CVE-2022-1388.sh hosts.txt CVE-2022-1388 RCE POC Exploit Don't forget to change the IP address root@kitploit: curl -X POST http://10.0.0.1/mgmt/tm/util/bash -d "'command':'run','utilCmdArgs':-e 'cat...

mcafee-sitelist-pwd-decryption

用于 McAfee SiteList.xml 文件的 Python3 密码解密工具。 作者： [email protected] 博客： http://funoverip.net 日期： Feb 10 2016 参考资料： https://funoverip.net/2016/02/mcafee-sitelist-xml-password-decryption/ https://www.reddit.com/r/netsec/comments/43mni7/mcafeeprivilegedsitelistxmlleadstoactive/...

React2Shell

React2Shell 📌 React2Shell CVE-2025-55182 React2Shell is the informal name given to a critical Remote Code Execution RCE vulnerability affecting React Server Components RSC and related frameworks like Next.js. Its severity and potential impact have made it a major concern in the web development an...

misfortune-cookie

CVE-2014-9222 "Misfortune Cookie" PoC suite Stack overflow in...

AlanFramework

Alan Framework Alan Framework is a post-exploitation framework useful during red-team activities. If you find my tool useful, please consider tosponsor me. ⚠⚠⚠ Disclaimer ⚠⚠⚠ The creation of this kind of software has always caused controversies. If you're wondering why I decided to create this...

CVE-2014-6271

Shellshock Exploitation CVE-2014-6271 Shellshock is effectively a Remote Command Execution vulnerability in BASH. This script exploits the vulnerability in the web environment on apache or similar with modcgi enabled. The vulnerability lies in the manipulation of environment variables, which are...

misp-taxonomies

MISP 分类法 MISP 分类法是一套通用的分类库，用于标记、分类和组织信息。分类法能够在分布式用户和组织之间表达相同的词汇表。 可用于 MISP 及其他信息共享工具的分类法以机器标签（三元标签）的形式表达。机器标签由命名空间（必须）、谓词（必须）和（可选的）值组成。由于其格式，机器标签通常被称为三元标签。 以下分类法可用于 MISP（作为本地或分布式标签），也可用于其他愿意在安全信息共享工具之间共享通用分类法的工具和软件。 可用分类法列表 CERT-XLM CERT-XLM ： CERT-XLM 安全事件分类。概览 DFRLab-dichotomies-of-disinformati...

LinuxCheck

LinuxCheck Linux emergency response/information gathering/vulnerability detection tool, supporting 13 categories and 70+ checks including basic configuration/network traffic/task scheduling/environment variables/user information/Services/bash/malicious files/kernel Rootkit/SSH/Webshell/mining...

CVE-2022-30190-NSIS

MSDT Patcher, a.k.a. CVE-2022-30190-NSIS This is an NSIS script that helps deploy and roll back the mitigation registry patch for CVE-2022-30190 as recommended by Microsoft. Download the executable here. How does it work? When run, it checks for the presence of the key HKCR\ms-msdt. If the key...

rails-rce-cve-2016-0752

Exploiting CVE-2016-0752 This app serves as a vulnerable Proof of Concept for exploiting CVE-2016-0752. For more information refer to this blog post, which explains the vulnerability, the steps required to exploit, the fix, and a link to a metasploit module. Getting Started root@kitploit: echo ""...

cve-2019-2618

cve-2019-2618 Weblogic Upload Vulnerability Requires username password - CVE-2019-2618 Python Usage root@kitploit: python CVE-2019-2618.py url username password Decrypt Weblogic Password root@kitploit: root@f0cb7e674d7e:/Oracle cat...

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 Langflow RCE PoC ★ 实验环境搭建 root@kitploit: docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 描述 1.3.0 之前的 Langflow 版本在 /api/v1/validate/code 端点中容易受到代码注入的影响。远程且未经认证的攻击者可以发送特制的 HTTP 请求来执行任意代码。...

c41n

c41n c41n is an automated Rogue Access Point setup tool. c41n provides automated setup of several types of Rogue Access Points, and Evil Twin attacks. c41n sets up an access point with user defined characteristics interface, name and channel for the access point, sets up DHCP server for the acces...