ntlm_relay_gat

NTLM Relay Gat Description NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines the process of exploiting NTLM relay vulnerabilities,...

MSSqlPwner

MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM Hashes, and kerberos tickets. With MSSqlPwner, users can...

enumdb

enumdb Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search fo...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

LabS4U2Self

Lab S4U2Self Abuse This lab aims to provide a safe environment to test the S4U2Self abuse exploit Deploy The project will deploy : 1 DC with a single domain admin hpotter 1 MSSQL with a weak sa password The deployment is performed through terraform and ansible on AWS thus, both these software mus...

CVE-2020-15394-PoC

CVE-2020-15394 DBMS: MSSQL TRUE condition in sql query POST /AppManager/json/ApmAdminServices/checkResourceID HTTP/1.1 Host: redacted.com Content-Type: application/x-www-form-urlencoded Content-Length: 67 resourceIds=1+AND+SELECT+CASE+WHEN+1=1+THEN+1+ELSE+1/0+END=1-- HTTP/1.1 200 Set-Cookie:...

jok3r

.. raw:: html .. image:: ./pictures/logo.png .. raw:: html Jok3r v3 beta .. image:: https://img.shields.io/badge/python-3.6-blue.svg :target: https://www.python.org/downloads/release/python-366/ :alt: Python 3.6 .. image:: https://readthedocs.org/projects/jok3r/badge/?version=latest :target:...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

sccmsqlclient

sccmsqlclient A dedicated MSSQL client for SCCM database exploration and exploitation. Recon queries Run PowerShell scripts on managed clients Extract secrets Installation PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP You can install by cloning the repository and...

mssqlbof

mssqlbof A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself, in C. No msodbcsql.dll, no sqloledb.dll, no .NET CLR, no PowerShell. One COFF per arch, loads into every beacon that honors the canonical Beacon API. Why SQL Server shows up on nearly every...

MSSQL-Pentest-Cheatsheet

🗄️ MSSQL Pentest Cheatsheet A practical Microsoft SQL Server penetration testing cheat sheet designed for penetration testers, red teamers, and cybersecurity learners to understand how to enumerate, exploit, and abuse misconfigured MSSQL databases during security assessments. 🌐 Connect With Us 🔵...

Exploit-CVE-2026-56705

CVE-2026-56705 – Adminer MSSQL DSN Injection Mass Exploiter 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs 📌 Description This tool exploits CVE-2026-56705 , an unauthenticated Remote Code Execution RCE vulnerability in Adminer 5.4.3...

CVE-2026-56705

CVE-2026-56705: Adminer dsn"sqlsrv:Server=$host" . $port ? ",$port" : "", $username, $password; Semicolons in server are treated as ODBC connection-attribute delimiters, so an unauthenticated attacker can append arbitrary attributes to the DSN — including TraceFile and TraceOn. The unixODBC trace...

CVE-2026-102462

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the TDS message decoder in the Vert.x MSSQL client vertx-mssql-client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or...

EUVD-2026-101961

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the TDS message decoder in the Vert.x MSSQL client vertx-mssql-client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or...

CVE-2026-102462

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the TDS message decoder in the Vert.x MSSQL client vertx-mssql-client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or...

CVE-2026-102462

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the TDS message decoder in the Vert.x MSSQL client vertx-mssql-client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or...

CVE-2026-102462

The io.vertx:vertx-mssql-client component in Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0] contains a vulnerability in the TDS message decoder . The decoder aggregates inbound TDS packets into a composite direct-memory buffer without a cumulative siz...

mssql-command-tool

mssql Terminal Connection Tool | Command Execution Example ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "whoami" nt service\mssqlserver ./mssql-command-tool-mac -s 10.10.10.10 -u sa -p jas502n -P 1433 -c "net user" \ 的用户帐户...