WarChild

War Child Warchild는 웹사이트가 다양한 종류의 서비스 거부 공격주로 사기꾼들이 웹사이트에 피해를 입히기 위해 조직하는 공격에 대해 얼마나 강력한지 분석하기 위해 만들어진 서비스 거부 테스트 스위트입니다. 대체 텍스트 설치 For Installing the required modules just run the following command in your terminal : pip install -r requirements.txt 사용 python warchild.py 개요 이 Denial Of Service 스위...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

CVE-2022-29337

CVE-2022-29337 C-DATA FD702XW-X-R430 v2.1.13X001에서 formlanipv6의 vacmd 매개변수를 통한 명령 주입 취약점이 발견되었습니다. 이 취약점으로 인해 공격자는 조작된 HTTP 요청을 통해 임의의 명령을 실행할 수 있습니다...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

log-add-http-post-bodies

HTTPログにPOSTボディの抜粋を追加 このスクリプトは、アナリストがHTTP POSTボディで送信されている内容を覗き見る機能を提供します。これはHTTPログを拡張するだけで実現されます。 インストール :: zkg refresh zkg install corelight/log-add-http-post-bodies 使用方法 HTTPログには、 postbody という名前の新しいフィールドが追加され、検出されたすべてのPOSTボディの先頭から設定可能な量のデータが格納されます。...

http-request-smuggler

HTTP Request Smuggler 이 Burp Suite 확장 프로그램은 PortSwigger 연구원 James Kettle이 개발한 고급 desynchronization 기술을 사용하여 HTTP Request Smuggling 취약점을 자동으로 탐지하고 악용합니다. HTTP/1.1 및 HTTP/2-downgrade desync 취약점, 클라이언트 측 desync, 연결 상태 공격에 대한 포괄적인 스캐닝을 지원합니다. 버전 3.0은 2025년에 출시되어 광범위한 desync 방어를 우회하고 훨씬 더 효과적으로 만드는 파서...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

htrace.sh

설명 htrace.sh는 HTTP/HTTPS 문제 해결 및 프로파일링을 위한 셸 스크립트입니다. 또한 여러 오픈 소스 보안 도구를 간단히 래핑한 것입니다. htrace.sh의 매개변수, 기능 및 작동 방식에 대한 자세한 내용을 보려면 htrace.sh --examples를 실행하거나 Wiki를 참조하세요. 미리보기 사용 방법 htrace.sh 자체를 설치하려면: Clone this repository git clone https://github.com/trimstray/htrace.sh Go into directory cd...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

Citrix SD-WAN Center - Local File Inclusion

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Apache Tomcat - HTTP Request Smuggling

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicio...

Emlog Pro v2.1.14 - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. id: CVE-2023-41621 info: name: Emlog Pro v2.1.14 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross Site Scripting XSS vulnerability in Emlog Pro v2.1.14 via /admin/store.php. impact: ...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...