remote-method-guesser

远程方法猜测器 remote-method-guesser rmg 是一个 Java RMI 漏洞扫描器，可用于识别和验证 Java RMI 端点上常见的安全漏洞。 remote-method-guesser 在 Black Hat USA2021 的 Arsenal 环节中进行了展示。该环节的录像及相应的幻灯片已公开，可通过以下链接获取： 幻灯片：https://www.slideshare.net/TobiasNeitzel/remotemethodguesser-bhusa2021-arsenal 录像：https://youtu.be/taw1mDNhzI...

monitorr-exploit-toolkit

Monitorr exploit toolkit RCE via unsecure file upload PHP reverse shell, webshell, etc. Administrator account creation via Authorization bypass Technical information leakage : Monitorr version, PHP version, System version & kernel, PHP config, etc. Exploit for CVE-2020-28872 and CVE-2020-28871...

autoSource

AutoSource AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLCSoftware Development Life Cycle. The user can scan th...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

CVE-2018-9206-jquery-file-upload

CVE-2018-9206 - Blueimp jQuery-File-Upload Lab Vulnerable Docker environment for CVE-2018-9206 - Unrestricted File Upload in Blueimp jQuery-File-Upload ' Execute it curl "http://localhost:8888/jQuery-File-Upload/server/php/files/test.php" Output: CVE-2018-9206-PWNED Or run the PoC script:...

PowerMeta

PowerMeta PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them c...

killerbee

KillerBee KillerBee 是一个用于测试和审计 ZigBee 及 IEEE 802.15.4 网络的框架与工具集 注意 usb0.x 支持正在被弃用/移除 Apimote v1 支持正在被弃用/移除 如果你需要这些功能，请创建一个 issue 说明你的使用场景和需求。 KillerBee 3.0.0-beta 更新 大家好，感谢大家一直以来对 KillerBee 的支持与关注。 当我们正在投入新精力清理代码、迁移到 Python 3、添加功能、提升一致性与连贯性时，我们利用这次重构的机会重新审视项目的目标和用途，以及实现这些目标的最佳方式。...

CVE-2024-36401

CVE-2024-36401 Remote Code Execution RCE Vulnerability In Evaluating Property Name Expressions GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution RCE by...

UhOh365

UhOh365 A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerabilit...

CVE-2023-42793

CVE-2023-42793 JetBrains TeamCity before 2023.05.4 is vulnerable to authentication bypass leading to RCE Usage To get a reverse shell root@kitploit: python3 exploit.py References https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/...

libmsm_cameraconfig_exploit

Original code is written by @tewilove http://pastebin.com/8BPCDc4i...

struts-pwn

struts-pwn An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL...

struts-pwn

struts-pwn Apache Struts CVE-2017-5638 的漏洞利用工具 用法 测试单个 URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' 测试 URL 列表. python struts-pwn.py --list 'urls.txt' -c 'id' 检查单个 URL 是否存在漏洞. python struts-pwn.py --check --url...

CVE-2025-9074

CVE-2025-9074: Docker Engine API Unauthenticated RCE Severity : CRITICAL | CVSS Score : 9.8 estimated | Affected Versions : Docker Desktop 4.44.3 A proof-of-concept exploit for CVE-2025-9074, an unauthenticated Remote Code Execution vulnerability in Docker Engine API that allows privileged...

opensshenum

Description: Opensshenum is an OpenSsh user enumerator permitting to verify an arbitrary list of user names against an OpenSsh server, to know those actually presents on that remote machine. This program exploits a bug corrected in July 2018 proven to be effective at least starting from OpenSSH...

pivotool

pivotool pivotool in ethical hacking, as expected, is a simple tool written in bash that could help you in the post exploitation phase to pivot to other systems. Description Pivotool is a tool that does not pretend to revolutionize the post exploitation phase of a penetration test, but it can hel...

CVE-2025-39247

CVE-2025-39247 Target: HikCentral Professional HCMP, central VMS server CVE: CVE-2025-39247 — Access Control Vulnerability CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected: V2.3.1 – V2.6.2 and V3.0.0 Fixed: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Disclosed: 2025-08-28 Analysis date:...

fapro

FaPro 免费、跨平台、单文件部署的网络协议服务端模拟器 README of English 简介 FaPro是一个服务端协议模拟工具,可以轻松启停多个网络服务。 目标是支持尽可能多的协议，每个协议尽可能提供深度的交互支持。 示例网站 特性 支持的运行模式 本地模式 虚拟网络 支持的网络协议 DNS DCE/RPC EIP Elasticsearch FTP HTTP IEC 104 Memcached Modbus MQTT MySQL RDP Redis S7 SMB 协议模拟演示 Rdp 支持 credssp ntlmv2 nla 认证。 支持配置用户登陆时的图片。 SSH...

CloudBrute

CloudBrute 一款用于在顶级云提供商（Amazon、Google、Microsoft、DigitalOcean、Alibaba、Vultr、Linode）上查找公司（目标）基础设施、文件和应用程序的工具。 该结果对漏洞赏金猎人、红队成员以及渗透测试人员同样有用。 完整的文章可在此处获取。 概览 动机 我们一直在思考如何使黑盒安全测试更加自动化。我们讨论了创建一个多平台云暴力破解猎人的想法，主要用于查找云上开放的存储桶、应用程序和数据库，以及代理服务器后面的应用。以下是我们在先前方法中试图解决的问题列表： 独立的字典 缺乏适当的并发 缺乏对所有主流云提供商的支持 需要身份验证、密钥...

CVE-2017-9096-iText-XXE

CVE-2017-9096 1. Creating the malicious PDF containing XXE Get a PDF containing a form: root@kitploit: wget https://www.pdfscripting.com/public/FreeStuff/PDFSamples/ModifySubmitExample.pdf -O input.pdf Decompress PDF To do that you need to decompress the PDF with qpdf --qdf...