PoC-CVE-2000-0649

PoC-CVE-2000-0649 一个用于为 CVE-2000-0649 创建 PoC 的小工具。 用法 此脚本用于验证服务器是否存在 CVE-2000-0649 漏洞。请注意尝试 HTTP、HTTPS 以及不同的路径。根据我的经验，信息泄露大多发生在通过 HTTP 连接并使用默认路径 '/' 或 '/images' 时。 你需要提供主机/IP 地址和端口。默认情况下路径设置为 '/'。你也可以选择性地指定以 '/' 开头的路径。 root@kitploit: $ python3 cve-2000-0649.py -host hostname -port port -path path...

CVE-2017-1000486

CVE-2017-1000486 用于 PrimeFaces 5.x 的远程代码执行利用 - EL 注入 CVE-2017-1000486 这基本上是 Mogwailabs 制作的同一利用程序，但经过修改，可在无法访问互联网或防火墙阻止出站流量的封闭环境中工作。 它会将结果输出到 HTTP 响应头中，因此如果你之前想用旧版利用工具进行盲 RCE 却无法实现，现在可以了。 使用方法 root@kitploit: python3 primefaces.py -t vulnapp.com id 欢迎根据实际端点编辑 vulnpoint 变量。...

pathprober

pathprober Probe and discover HTTP pathname using brute-force methodology and filtered by specific word or 2 words at once. Purpose Brute-forcing website directories or HTTP pathname and validate using HTTP response code is not relevant anymore. This tool will help you to perform a penetration...

Linux Distros Unpatched Vulnerability : CVE-2026-45759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Surica...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

CVE-2024-46982-Reproduction

开始使用 1. 安装 Node.js LTS 2. npm install 3. npm run build 4. npm run start 利用方法 1：通过缓存投毒实现存储型 XSS 1. 使用任意 HTTP 客户端发送以下 HTTP 请求（攻击请求）。 root@kitploit: GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS' x-now-route-matches: 1 2. 使用任意 Web 浏览器访问 http://localhost:3000（正常请求）。 利用方法...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

CVE-2023-3519

CVE-2023-3519 NetScaler Citrix ADC CVE-2023-3519 扫描器 一个简单的扫描器，用于查找 NetScaler 并检查 HTTP 响应头中的最后修改日期 这个项目是我用 C 编写的扫描器，使用了 mrr3b00t 用 PowerShell 编写的源代码...

CVE-2022-37177

CVE-2022-37177 - HireVue-Broken-Or-Risky-Cryptographic-Algorithm 当访问 HireVue 为面试提供的面试邀请链接时，你会被引导到一个条款页面，在开始录制并计时的面试过程之前，你需要先同意这些条款。这个初始 HTTP 响应中包含了面试过程中会被问到的面试问题，这些问题使用栅栏密码（rail fence cipher）进行编码。这种编码很容易被解密，因此在实际开始面试之前就能获得所有面试问题。如果你不同意条款，面试就不会开始，所以你可以随意反复访问该链接然后离开，直到你同意开始面试为止。HireVue...

CVE-2023-0214

SWG Exploit Generator root@kitploit: ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhi...

ibm-qradar-ajp_smuggling_CVE-2022-26377_poc

CVE-2022-26377 A Proof of Concept developed by @watchTowr to exploit an AJP Smuggling vulnerability to poison the HTTP Response Queue of an IBM QRadar instance with a stored redirect. Follow the watchTowr Labs Team for our Security Research https://labs.watchtowr.com/...

CVE-2026-18540

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

Stream Corruption

Spring Framework is vulnerable to stream corruption. The vulnerability is due to improper handling of response streams when processing SSE with view fragments, which allows an attacker to potentially corrupt or disrupt the application’s HTTP response stream...

UBUNTU-CVE-2026-84933

undicis cache interceptor does not handle the Set-Cookie response hea...

GHSA-JCVH-XF52-2CWM ffuf denial of service (OOM) via HTTP response decompression bomb

Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222 NGINX ngx_http_js_module vulnerability

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...