slipstream

NAT Slipstreaming NAT Slipstreaming permite a un atacante acceder remotamente a cualquier servicio TCP/UDP vinculado a cualquier sistema detrás del NAT de la víctima, evitando el NAT/cortafuegos de la víctima control remoto arbitrario de agujeros en el cortafuegos, simplemente con que la víctima...

Review.CVE-2023-5612

CVE-2023-5612 – SSRF en GitLab mediante URL de Webhook PoC y análisis 📌 Resumen del CVE CVE-ID: CVE-2023-5612 Severidad: Alta CVSS: 8.1, puntuación base Tipo: Server-Side Request Forgery SSRF Componente: Webhooks de GitLab CE/EE Versiones afectadas: GitLab CE/EE " \ --data-urlencode...

sonar.js

sonar.js Un framework para identificar y lanzar exploits contra hosts de la red interna. Funciona mediante enumeración de IPs por WebRTC, escaneo de hosts por WebSocket y fingerprinting de recursos externos. ¿Cómo funciona? Al cargar el payload sonar.js en un navegador web moderno ocurrirá lo...

sonar.js

sonar.js A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar....

EUVD-2026-78232

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

PT-2026-91771

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

Stowaway

Stowaway Stowaway is a multi-hop proxy tool for security researchers and penetration testers. Stowaway lets you proxy external traffic through multiple hops into a target internal network, bypassing access restrictions, building a tree-like node topology, and managing it easily. Thanks for the...

Moodle-CVE-2018-1042

Moodle CVE-2018-1042 Script to exploit CVE-2018-1042 in order to do internal port scans...

CVE-2026-33234

How I Turned AutoGPT's Email Feature Into an Internal Network Scanner CVE-2026-33234 | Moderate 5.0 | GHSA-4jwj-6mg5-wrwf Author: Pavan Nallamothu I was mapping every user-controlled input that touched the network in AutoGPT Platform. The HTTP layer was locked down tight. Private IP ranges...

leprechaun

Leprechaun root@kitploit: .-----. / V \ |...| |.....| .-' '-. .-. .-./ .--. |\ /| .-;.-"-.-;;-, =/ . -;,-;, . .-.-. . / ||'-'|| \ ,'--;.\ .;--' // o \ // --.. o '';,//| || : || |\ ;' \ '.\--' |"""""""|// / ':.// ,/\ | '---'| ||| ; Leprechaun ; ;""|""; \ / | '. vonahisec .' .' / \ '. '-,...

stunner

STUNNER Stunner es una herramienta para probar y explotar servidores STUN, TURN y TURN sobre TCP. TURN es un protocolo usado principalmente en videoconferencias y chats de audio WebRTC. Si encuentras un servidor mal configurado, puedes usar esta herramienta para abrir un proxy socks local que...

CVE-2026-91081

Docs by Suitenumerique (versions through 5.6.1 ) contains a server-side request forgery (SSRF) vulnerability in the cors-proxy endpoint. The root cause involves DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypasses , allowing anonymous attackers to forge outboun...

EUVD-2026-77716

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

pd-agent

ProjectDiscovery Cloud Platform — Agente Qué hace • Inicio rápido • Instalación • Configuración • Escalado Qué hace pd-agent le permite escanear sus propias redes internas desde la ProjectDiscovery Cloud Platform. Instale el agente en una máquina dentro de la red que quiera escanear — una VM, un...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

fscan

Fscan English 内网综合扫描工具，一键自动化漏扫。 版本 : 2.2.1 功能特性 扫描能力 主机发现 - ICMP/Ping存活探测，支持大网段B/C段存活统计 端口扫描 - TCP全连接扫描，内置133个常用端口，支持端口组web/db/service/all 服务识别 - 智能协议识别，支持20+种服务指纹匹配 Web探测 - 网站标题、CMS指纹、Web中间件、WAF/CDN识别40+指纹 爆破能力 弱密码爆破 - 28种服务爆破SSH/RDP/SMB/FTP/MySQL/MSSQL/Oracle/Redis等 Hash碰撞 - 支持NTLM...

Astra Linux – Vulnerability in Firefox and Thunderbird

Using techniques based on slipstream research, a malicious webpage could scan both the hosts of an internal network and the services running on the user’s local machine, using WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

CVE-2023-25203

CVE-2023-25203: Application vulnerable to SSRF Server Side Request Forgery attacks Description CVE-2023-25203 identifies a vulnerability within the Therefore solution, which is susceptible to Server-Side Request Forgery SSRF attacks due to its use of Aspose software for converting uploaded files...

CVE-2023-27163

Prueba de Concepto de SSRF en Request-Baskets CVE-2023-27163 Este repositorio contiene una Prueba de Concepto PoC para CVE-2023-27163, una vulnerabilidad de Server-Side Request Forgery SSRF descubierta en request-baskets hasta la versión 1.2.1. Esta vulnerabilidad permite a los atacantes acceder ...