BurpSuiteSharpenerEx

Burp Suite Sharpener Esta extensión mejora Burp Suite añadiendo varias características de interfaz de usuario y funcionales, lo que la hace más fácil de usar. Consulte la sección "Compatibilidad de Burp Suite y notificación de errores" para obtener información detallada sobre la compatibilidad. /...

bouncy-castle-generative-test-poc

Generative testing bouncy castle vulnerability CVE-2020-28052 Running the tests Test the vulnerable versions defaults to 1.66 $ clojure -M:test $ clojure -M:test:v1.65 Test the versions before the vuln and after the patch 1.67 $ clojure -M:test:v1.64 $ clojure -M:test:patched Links...

CVE-2022-21449-vuln-test

CVE-2022-21449 Vulnerability tester Introduction There's a new CVE-2022-21449 that had bug in ECDSA signature verification. It's one of the algorithms used with JWT for example. Citing the blog post If you have deployed Java 15, Java 16, Java 17, or Java 18 in production then you should stop what...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Using Burp Suite to Exploit Java Deserialization Vulnerabilities 0x01 Setting Up the Jboss JMXInvokerServlet Deserialization Vulnerability Test Environment: Jboss JMXInvokerServlet Deserialization Vulnerability Vulnerability Principle: JBoss reads the...

PoC

PoC Repositorio de exploits y herramientas de prueba de concepto. BMCRSCDRCE Exploit de ejecución remota de comandos no autenticado para el agente RSCD de BMC Server Automation. El exploit funciona contra servidores afectados por CVE-2016-1542 detectado por Nessus. Esto ahora es un módulo de...

log4j-rce-test

Build ./build.sh Start log4j RCE Server ./start-log4j-rce-server.sh Test Run java -cp log4j-rce-1.0-SNAPSHOT-all.jar log4j Check if you get logs in hack.log from current folder You can change this line String cmds = "sh", "-c", "echo 'Exploit at '" + getDateString + " ./hack.log" ; in file...

SpringCloudGatewayRCE

SpringCloudGateway Remote Command Execution Vulnerability Code By: Tas9er 0x00 Risk Overview This tool is intended for authorized security testing only. Unauthorized attacks on systems are prohibited. 0x01 Tool Usage java -jar SpringCloudGatewayRCE.jar 0x02 Bug Issues Will address later...

CVE-2021-44228

CVE-2021-44228 Vulnerability recurrence 1. Run RmiServer first to create an RMI registry service. 2. Run Log4jTest, if you use Windows, the calculator will appear...

CVE-2017-12149

CVE-2017-12149 Jboss Java Deserialization RCE CVE-2017-12149 The python script uses ysoserial to dynamically generate the payload. Therefore java is required as well...

CVE-2021-44228-Apache-Log4j

CVE-2021-44228Apache Log4j Remote Code Execution） Versions Affected: all versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 Security Advisories / Bulletins linked to Log4Shell CVE-2021-44228 Usage: 1. 下载该项目，编译InjectClazz.java download git clone...

log4j-detector

Log4-detector Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228 CRITICAL, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It...

log4j-detector

Log4-detector Escáner que detecta versiones vulnerables de Log4J para ayudar a los equipos a evaluar su exposición a CVE-2021-44228 CRÍTICA, CVE-2021-45046, CVE-2021-45105 y CVE-2021-44832. Puede buscar instancias de Log4J examinando cuidadosamente el sistema de archivos completo, incluyendo toda...

snuck

snuck Automatic XSS filter bypass Overview snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker and the victim...

msmap

MSMAP Msmap es un generador de WebShells en Memoria. Compatible con varios Contenedores, Componentes, Codificadores, WebShell / Proxy / Killer y Clientes de Gestión. 简体中文 La idea detrás I, La idea detrás II, La idea detrás III Características WIP Función Menú Dinámico Compilación Automática Gener...

msmap

MSMAP Msmap is a Memory WebShell Generator. Compatible with various Containers, Components, Encoder, WebShell / Proxy / Killer and Management Clients. 简体中文 The idea behind I, The idea behind II, The idea behind III Feature WIP Function Dynamic Menu Automatic Compilation Generate Script Lite Mode...

CVE-2022-39197

CVE-2022-39197 RCE POC Reference Links https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg — There’s a great in depth analysis of this vulnerability https://www.agarri.fr/blog/archives/2012/05/11/svgfilesandjavacodeexecution/index.html...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

CLEANSTART-2026-KK18805 In Bouncy Castle for Java before 1

CVE-2026-58059 affects multiple packages. In Bouncy Castle for Java before 1. See references for individual vulnerability details...

CVE-2026-43865

camel-hazelcast Default-Instance Unsafe Deserialization Reproducer CVE-2026-43865 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-hazelcast component, tracked as CVE-2026-43865. When Camel builds the Hazelcast Config itself — i.e. when no user-supplied...

CVE-2017-3066

CVE-2017-3066 Description Adobe ColdFusion uses message format the Action AMF. The AMF Protocol is a custom binary serialization Protocol. It has two formats: AMF0 and AMF3. Action message consists of headers and bodies. There are several implementations of AMF in different languages. For Java we...