ClipBucket beats_uploader Unauthenticated Arbitrary File Upload

This module exploits a vulnerability found in ClipBucket versions before 4.0.0 Release 4902. A malicious file can be uploaded using an unauthenticated arbitrary file upload vulnerability. It is possible for an attacker to upload a malicious script to issue operating system commands. This issue is...

Joomla DT Register 3.2.7 Component - id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component DT Register 3.2.7 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://www.dthdevelopment.com/ Software Link:...

roxysploit - Penetration Testing Suite

roxysploit is a community-supported, open-source and penetration testing suite that supports attacks for numerous scenarios. conducting attacks in the field. Some containing Plugins in roxysploit Scan is a automated Information gathering plugin it gives the user the ability to have a rest while t...

UPDATE: Kali Linux 2018.1 Release!

PenTestIT RSS Feed Second post of the new year and it is about the latest Kali Linux 2018.1 release! The last Kali Linux release was made available in the month of November. As usual, this new release includes all patches, fixes, updates, and improvements since the last release - Kali Linux 2017....

Kali Linux 2018.1 Release - The Best Penetration Testing Distribution

Kali Linux 2018.1 the first release of 2018, this fine release contains all updated packages and bug fixes since our 2017.3 release last November. This release wasn’t without its challenges–from the Meltdown and Spectre excitement patches will be in the 4.15 kernel to a couple of other nasty bugs...

Advance Loan Management System - id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Advance Loan Management System - 'id' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/ Software Link:...

Advance Loan Management System 1.0 SQL Injection

Exploit Title: Advance Loan Management System - 'id' SQL Injection Date: 2018-01-31 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/advance-loan-management-system-with-savings-system-and-sms-notification/21283070 Version: 1.0 Tested on:...

SocialFish - Ultimate phishing tool with Ngrok integrated

Ultimate phishing tool with Ngrok integrated. PREREQUISITES Python 2.7 Wget from Python PHP TESTED ON Kali Linux - ROLLING EDITION CLONE git clone https://github.com/UndeadSec/SocialFish.git RUNNING cd SocialFish sudo pip install -r requirements.txt python SocialFish.py AVAILABLE PAGES + Facebook...

EvilURL v2.0 - An Unicode Domain Phishing Generator for IDN Homograph Attack

Generate unicode evil domains for IDN Homograph Attack and detect them. PREREQUISITES python 3.x for evilurl3.py TESTED ON:Kali Linux - ROLLING EDITION CLONE git clone https://github.com/UndeadSec/EvilURL.git RUNNING cd EvilURL python3 evilurl.py CHANGELOG Full script updated to Python 3.x Python...

Linux/x86-64 - Add User (pwned/$pass$) Using open,write,close Shellcode (358 bytes)

; shellcode name adduserpasswordJCPopen,write,close ; Author : Christophe G SLAE64-1337 ; Len : 358 bytes ; Language : Nasm ; "name = pwned ; pass = $pass$" ; add user and password with open,write,close ; tested kali linux , kernel 3.12 global start start: xor rax , rax push rax pop rsi push rax ...

Network Infrastructure Penetration Testing: SPARTA

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

Joomla Varista Education 2.9 SQL Injection

Exploit Title: Varista Education Joomla Template - SQL Injection Vulnerability Google Dork: N/A Date: 30.12.2017 Author: Abdeljalil Nouiri @pwny url : https://www.joomshaper.com/joomla-templates/varsita Version : 2.9 Tested on: Kali Linux proof : https://ibb.co/mo8wnG Description : Varsita is a...

Joomla SP Movie Database 1.4 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SP Movie Database - SQL Injection Vulnerability Google Dork: inurl:option=comspmoviedb Date: 29.12.2017 Author: pwny Source Component : https://extensions.joomla.org/extension/sp-movie-database/ Version : 1.4 Tested on: Kali Lin...

Joomla Varista Education 2.9 SQL Injection Vulnerability

Joomla Varista Education template version 2.9 suffers from a remote SQL injection vulnerability. Exploit Title: Varista Education Joomla Template - SQL Injection Vulnerability Google Dork: N/A Date: 30.12.2017 Author: Abdeljalil Nouiri @pwny url : https://www.joomshaper.com/joomla-templates/varsi...

GoodTravel Travel And Locations 1.0 Cross Site Scripting Vulnerability

GoodTravel Travel and Locations PHP script and mobile application version 1.0 suffers from a cross site scripting vulnerability. Exploit Title: GoodTravel - Travel & Locations PHP Script & Mobile App - xss Google Dork: N/A Date: 2017/28/12 Exploit Author: ShanoWeb Author Mail :...

Joomla SP Movie Database 1.4 SQL Injection

Exploit Title: SP Movie Database - SQL Injection Vulnerability Google Dork: inurl:option=comspmoviedb Date: 29.12.2017 Author: pwny Source Component : https://extensions.joomla.org/extension/sp-movie-database/ Version : 1.4 Tested on: Kali Linux proof : https://ibb.co/cjdiZw Search Form in Home...

Tripbuddy Travel, Locations, And Events 1.0 Cross Site Scripting

Exploit Title: Tripbuddy - Travel, Locations and Events Web App - xss Google Dork: N/A Date: 2017/28/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://tripbuddy-app.com/ Software Buy:...

Online Hotel Booking System Pro 1.3 Cross Site Scripting

Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting Google Dork: N/A Date: 2017/08/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://www.bestsoftinc.com/ Software Buy: https://codecanyon.net/item/online-hotel-booking-system-pro/46065...

WordPress mgl-instagram-gallery Plugin Cross Site Scripting Vulnerability

Exploit for php platform in category web applications + Title: WordPress mgl-instagram-gallery Plugin Cross Site Scripting XSS + Author: Mostafa Gharzi + Vendor Homepage: www.Wordpress.org , www.pluginu.com/mgl-instagram-gallery/ + Tested on: Windows 10 & Kali Linux + Vulnerable File:...

FS Facebook Clone - token SQL Injection

FS Facebook Clone - token SQL Injection Exploit Title: FS Facebook Clone - 'token' SQL Injection Date: 2017-12-06 Exploit Author: Dan° Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/facebook-clone/ Version: 2017-12-06 Tested on: Kali Linux 2.0 PoC:...