JNDI-Injection-Exploit-Plus

JNDI-Injection-Exploit-Plus 中文 README Description JNDI-Injection-Exploit-Plus is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. Using this tool allows you get JNDI links, you can insert these links into your POC to tes...

log4shell-homework9

Homework 9 – Securing Systems Against Log4Shell Exploits Overview This project demonstrates the exploitation and mitigation of the Log4Shell vulnerability CVE-2021-44228 using a Dockerized Java web application with vulnerable Log4j 2.14.1. The setup also includes a simulated malicious LDAP server...

docker-log4shell

docker-log4shell Simple Go app / Docker image for playing with the CVE-2021-44228 vulnerability. Hosts a simple file server and an ldap server that provides any classes hosted in the file server: ldap://ip:1389/Hello - http://ip:8080/Hello.class root@kitploit: docker build -t log4shell . docker r...

freeipa

FreeIPA Server FreeIPA allows Linux administrators to centrally manage identity, authentication and access control aspects of Linux and UNIX systems by providing simple to install and use command line and web based management tools. FreeIPA is built on top of well known Open Source components and...

l4srs

l4srs Rust implementation of the Log 4 Shell log 4 j - CVE-2021-44228 to build run cargo +nightly build This version will let you build command classes, dynamically serve a mini meterpreter that runs in a thread of the exploited Java app, and runs the LDAP and HTTP servers. This version servers...

l4s_poc

l4spoc Log4Shell Cve-2021-44228 Proof Of Concept This is a personal project that runs a simple POC that will host an LDAP server and an HTTP server for the Log4Shell exploit. Server The runservers.py will setup a stripped down meterpreter client that will call back to the Metasploit instance pass...

Odysseus

Odysseus A demo of the Log4Shell CVE-2021-44228 vulnerability. Build Instructions The vulnerable webserver and malicious LDAP server were both built and tested on JDK 1.8.0181. Good Guys Web Server 1. Inside goodguys, run gradlew bootJar 2. Run vulnerable webserver using java -jar...

CVE-2021-44228_dockernize

CVE-2021-44228 Log4Shell Vulnerability Lab Environment Introduction This project provides a dockerized environment for safely practicing and understanding the critical Log4j vulnerability known as CVE-2021-44228 Log4Shell. Key Features Secure dockerized testing environment Custom payload testing...

JNDI-Injection-Exploit

JNDI-Injection-Exploit Materials about JNDI Injection 中文文档 相关文章 Description JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further...

cve-2021-44228-log4j-test

cve-2021-44228-log4j-test Test 1. LDAP Server and Exploit File Download Server 1.1 Running Docker-compose docker-compose.yml root@kitploit: version: '2' services: dockerdj: image: openidentityplatform/opendj:latest containername: ldap environment: ROOTUSERDN: "cn=han" ROOTPASSWORD: "han" BASEDN:...

Log4j-Exploit-CVE-2021-44228

Log4j-Exploit-CVE-2021-44228 Herramienta de prueba de vulnerabilidad Log4Shell https://log4shell.tools/ Exploit con Java ya incluido, para evitar crear cuenta, etc. root@kitploit: http://www.mediafire.com/file/bs1spnysc6fbz1a/log4j-shell-poc%25281%2529.zip/file root@kitploit: pip install -r...

log4j

💻 -h3x0v3rl0rd- exploiting log4j CVE-2021-44228 TryHackMe Solar, Walkthrough root@kitploit: git clone https://github.com/n3rdh4x0r/log4j.git 1. run log4j.py This whill install all the nessasary applications and start the LDAP server root@kitploit: ifconfig tun0 python3 log4j.py 10.8.227.251 2...

389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

Critical: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Critical: Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.9 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Critical: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RHEL 6 : 389-ds-base (RHSA-2026:64811)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64811 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server a...

CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

ldap-swak

LDAP Swiss Army Knife Multi-function LDAP server utility. Quickly setup LDAP server for testing purposes, MitM proxies for intercepting plaintext or forwarding NTLM credentials or exploit various Java JNDI/LDAP Client vulnerabilities. Author: Moritz Bechler [email protected] Project...