evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

evilgophish

Tabla de Contenidos evilgophish Una palabra sobre el patrocinio Créditos Requisitos previos Descargo de responsabilidad ¿Por qué? Antecedentes Esquema de infraestructura setup.sh Configuración de Cloudflare Turnstile Guía de plantillas HTML de Cloudflare Turnstile replacerid.sh Configuración de...

CVE-2018-16763

Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install root@kitploit: git clone https://github.com/Trushal2004/CVE-2018-16763.git cd...

CVE-2021-26084

Confluence Server Webwork 预认证 OGNL 注入 CVE-2021-26084 Confluence 是由澳大利亚软件公司 Atlassian 开发的基于 Web 的企业维基。 存在一个 OGNL 注入漏洞，允许未经身份验证的攻击者在 Confluence Server 或 Data Center 实例上执行任意代码。 参考资料 https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html...

RingReaper

RingReaper RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage iouring , the new asynchronous I/O interface in the Linux kernel,...

CVE-2015-1635

️⃣ CVE-2015-1635 Requirements: Python = 3.6 Install requirements with: pip3 install -r requirements.txt Usage example: python3 MS15-034.py -u http://targeturl.com/ -c -d Args:...

CVE-2023-24055

免责声明 此脚本仅用于教育和演示目的。作者不支持也不纵容将此脚本用于任何犯罪或恶意活动，并且只能在获得明确许可并拥有适当授权的情况下使用。 使用此脚本时需谨慎，因为它会修改 KeePass 配置文件并删除所有先前配置的触发器。使用此脚本可能导致意外行为，甚至可能破坏 KeePass 应用程序。请自行承担风险。 简介 此脚本演示了 KeePass 至 2.53 版本（默认安装）中 争议性 的漏洞（CVE-2023-24055）。该漏洞允许拥有 XML 配置文件写入权限的攻击者通过添加导出触发器获取明文密码。请注意，供应商的立场是密码数据库本身并非旨在防范具有该级别本地 PC 访问权限的攻击...

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ Unauthenticated Privilege Escalation via Arbitrary Password Reset ☆ === Beelze === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-11387 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type| Missing Authenticatio...

OpenSSL-1_0_1g_CVE-2015-1791

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

OpenSSL-1_0_1g_CVE-2015-1792

OpenSSL 1.0.1g 2014年4月7日 版权所有 c 1998-2011 The OpenSSL Project 版权所有 c 1995-1998 Eric A. Young, Tim J. Hudson 保留所有权利。 描述 OpenSSL 项目是一项协作努力，旨在开发一个健壮、商业级、功能齐全的开源工具包，实现了安全套接字层（SSL v2/v3）和传输层安全（TLS v1）协议，以及一个全强度的通用密码库。该项目由全球志愿者社区通过互联网进行沟通、规划和开发 OpenSSL 工具包及其相关文档。 OpenSSL 基于 Eric A. Young 和 Tim J. Hudso...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

PartyLoud

Partyloud Recupera tu privacidad Genera navegación web falsa y mitiga el rastreo CodeFactor PartyLoud es una herramienta gratuita altamente configurable y sencilla que te ayuda a prevenir el rastreo directamente desde tu terminal Linux, sin necesidad de habilidades especiales. Una vez iniciada,...

EUVD-2026-78395

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-34207

CVE-2026-34207 SSRFフィルターはホスト名のテキストをチェックしていましたが、実際の接続先は後でDNSによって決定されました。このギャップにより、攻撃者が制御するWebhook URLがループバック、メタデータ、プライベートネットワークのターゲットに到達可能になりました。 はじめに この問題は、オープンソースのチャットボットビルダーであるTypebot をレビューしているときに、シンプルなセキュリティの問いを念頭に発見しました。 SSRF保護がホスト名のテキストを検証しても、実際の接続先が後でDNSによって決定されたらどうなるか？...

Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU Exhaustion Vulnerability PoC This repository contains a proof-of-concept PoC Python script to demonstrate the CPU exhaustion vulnerability in Envoy caused by a flood of CONTINUATION frames. Author: blackmagic 2024 Description Envoy is a cloud-native, open-source edge and service proxy...

text4shell-scan

text4shell-scan 一个全自动、准确且全面的扫描器，用于发现易受攻击的 text4shell 主机 特性 支持 URL 列表。 对超过 60 个 HTTP 请求头进行模糊测试。 对 HTTP POST 数据参数进行模糊测试。 对 JSON 数据参数进行模糊测试。 支持 DNS 回调进行漏洞发现与验证。 WAF 绕过有效载荷。 支持自定义 DNS OOB 回调（例如：Burpsuite Collaborator） 描述 该扫描工具大量基于 Fullhunt 2021 年的旧版 Log4j 扫描器（向他们致以重大感谢），现用于发现和模糊测试 Text4Shell...