http_bridge

Http Bridge Motivation I've wrote this program as a proof of concept to test the idea of be able to send tcp stream packets over simple http request like PUT, PATCH, POST, GET, without use a proxy way like CONNECT method. Also as a practice exercise to train my novice skill on rust language...

cve2018-13379-nmap-script

cve2018-13379-nmap-script CVE-2018-13379 Script for Nmap NSE An Improper Limitation of a Pathname to a Restricted Directory "Path Traversal" in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted...

ASUS-AiCloud-RCE

Origasus A Go program compiled with origasus.go, written for examining endpoints that can be associated with ASUS AiCloud / AsusWRT within the scope of authorized security testing or defense analysis e.g., your own device, a pentest lab environment. Important: The use of such software against...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

turbo-intruder

Turbo Intruder Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. It's intended to complement Burp Intruder by handling attacks that require exceptional speed, duration, or complexity. The following features set it apart: Fast - Turbo...

slowloris

slowloris.py - Simple slowloris in Python What is Slowloris? Slowloris is basically an HTTP Denial of Service attack that affects threaded servers. It works like this: 1. We start making lots of HTTP requests. 2. We send headers periodically every 15 seconds to keep the connections open. 3. We...

odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely. Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid...

CVE-2023-27163-exploit

CVE-2023-27163 — request-baskets SSRF Exploit I wrote this exploit to target CVE-2023-27163 , a Server-Side Request Forgery SSRF vulnerability found in request-baskets versions ≤ 1.2.1. The flaw lives in the /api/baskets/name endpoint, where the forwardurl parameter allows an attacker to make the...

Bulk_403_Bypass

Bulk 403 Bypass This is a Bash script that performs bulk 403 bypass by adding a custom header to HTTP requests. It can be useful for testing whether a website is vulnerable to 403 bypass techniques. Usage To use the script, pass in a list of URLs as a command line argument: ./403bypass.sh urls.tx...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

CVE-2024-23334-PoC

Path Traversal PoC CVE-2024-23334 This script is a proof of concept PoC for vulnerability CVE-2024-23334 related to a Path Traversal. The script attempts to access files outside the allowed root directory by manipulating paths in HTTP requests. Requirements To run this script, you will need to ha...

CVE-2020-14882-14883

CVE-2020-14882&14883 WebLogic is a J2EE application server launched by Oracle. CVE-2020-14882 is an unauthorized access vulnerability in the Console, with a severity rating of Critical and a CVSS score of 9.8. Meanwhile, CVE-2020-14883 is a code execution vulnerability in the Console that exploit...

http-pulse_ssl_vpn.nse

SUMMARY Simple NSE script to detect Pulse Secure SSL VPN file disclosure via specially crafted HTTP resource requests. This exploit reads /etc/passwd as a proof of concept This vulnerability affect 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. INSTALLATION $ git clone...

CVE-2023-44487

Please note that the above code uses the libcurl library for making HTTP requests. You need to install libcurl and link against it when compiling the code. The code is a simplified version, and you may need to adjust it based on your exact requirements and the specific behavior of the HTTP/2 atta...

CVE-2024-7954POC

CVE-2024-7954POC The porteplume plugin used in SPIP versions before 4.30-alpha2, 4.2.13, and 4.1.16 has an arbitrary code execution vulnerability. Remote unauthenticated attackers can execute arbitrary PHP code as SPIP users by sending specially crafted HTTP requests...

CVE-2020-3452

CVE-2020-3452 Little, stupid python validator? for CVE-2020-3452 on CISCO devices. Python first timer, pls do not kill me. ;- USAGE python CVE-2020-3452.py /path/to/input/file.txt /path/to/output/file.txt DISCLAIMER: Please use this script only on subjects you own or you have the permission to te...

sricam-gsoap2.8-dos-exploit

sricam-gsoap2.8-dos-exploit Sricam gSOAP2.8 DoS exploit proof of concept Proof of Concept code: SricamgSOAPPoCexploit.sh CVE-2019-6973 https://vulners.com/cve/CVE-2019-6973 Thanks to the CVE Assignment Team for their help structuring the following: Description Sricam IP CCTV cameras are vulnerabl...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

Re2Pcap

Re2Pcap: Create PCAP file from raw HTTP request or response in seconds Re2Pcap is abbreviation for Request2Pcap and Response2Pcap. Community users can quickly create PCAP file using Re2Pcap and test them against Snort rules. Re2Pcap allow you to quickly create PCAP file for raw HTTP request shown...

ReverseHttp

ReverseHttp Python backdoor that uses http post/get requests to communicate Requirement Python 2.7 Cherrypy pip install cherrypy Requests pip install requests Usage: Fireup the listener script then the controller then send the backdoor file and wait for connections Screenshot...