Hijacked Environment Variables

Overview The mssql-node package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this module is malware, if you find it installed in your environment, the real...

BruteSpray - Brute-Forcing from Nmap output (Automatically attempts default creds on found services)

BruteSpray takes nmap GNMAP output and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap. Usage First do an nmap scan with '-oA nmap.gnmap'. Command: python brutespray.py -h Example: python...

LLMNR NBT-NS MDNS Poisoner: Responder

LLMNR NBT-NS MDNS Poisoner: Responder Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. This tool is an LLMNR, NBT-NS and MDNS responder, it will...

SQL Injection

loopback-connector-mssql is vulnerable to SQL injection attacks. This is because user-supplied inputs are not properly sanitized before using them in SQL queries, allowing a remote attacker to inject or manipulate SQL queries in the back-end database...

Microsoft SQL Server Clr Stored Procedure Payload Execution Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Microsoft SQL Server Clr Stored Procedure Payload Execution',...

F-Scrack - A Single File Bruteforcer Supports Multi-Protocol

F-Scrack is a single file bruteforcer supports multi-protocol, no extra library requires except python standard library, which is ideal for a quick test. Currently support protocol: FTP, MySQL, MSSQL，MongoDB，Redis，Telnet，Elasticsearch，PostgreSQL. Compatible with OSX, Linux, Windows, Python 2.6+...

Fedora 23 : php (2016-db71b72137)

15 Sep 2016 PHP version 5.6.26 Core: - Fixed bug php72907 NULL pointer deref, segfault in gcremovezvalfrombuffer zendgc.c:260. Laruence Dba: - Fixed bug php71514 Bad dbareplace condition because of wrong API usage. cmb - Fixed bug php70825 Cannot fetch multiple values with group in ini file. cmb...

Fedora 24 : php (2016-62fc05fd68)

15 Sep 2016 PHP version 5.6.26 Core: - Fixed bug php72907 NULL pointer deref, segfault in gcremovezvalfrombuffer zendgc.c:260. Laruence Dba: - Fixed bug php71514 Bad dbareplace condition because of wrong API usage. cmb - Fixed bug php70825 Cannot fetch multiple values with group in ini file. cmb...

BLACKBOx - A Penetration Testing Framework

Password Attacks: MD5 CRACKER SHA1 CRACKER SHA224 CRACKER SHA256 CRACKER SHA384 CRACKER SHA512 CRACKER MSSQL2000 CRACKER MSSQL2005 CRACKER MYSQL323 CRACKER MYSQL41 CRACKER ORACLE11 CRACKER Web Hacking : Wordpress Bruteforce – Bruteforce wordpress panel FTP Bruteforce – Bruteforcing FTP LOGIN SSH...

DotCMS 3.3 SQL Injection

1¡¢Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2¡¢Product Summary ================ dotcms is a fully featured open source enterprise gra...

workyi人才系统2.5版本/news/search.aspx 参数key存在SQL注入漏洞

0x01 框架介绍 工作易人才招聘系统是由华兴科技网络开发的一套高端人才系统，并通过了国家计算机版权认证中心的认可。由.NET+ MSSQL编写，网站模板采用DIV+CSS构成，兼容IE6/IE7/IE8、火狐等主流内核浏览器，当然也兼容IE内核的傲游、世界之窗、腾讯TT等浏览器。 该网站主要由企业招聘、万能采集、手机版、木马检测、一句求贤、最新求职、人才评测、视频简历、院校联盟、个人服务、企业服务、资讯中心几大部分组成。工作易人才招聘系统是面向中小企业和个人站长建站时，最具性价比的一套人才招聘系统。以《实用、稳定、低价》的特色占据市场的一席之地。采用微软的.Net最新技术开发。...

Siemens WinCC Microsoft SQL (MSSQL) Server Default Credentials (TCP/IP Listener)

The remote Microsoft SQL MSSQL Server has Siemens WinCC related default credentials set. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

CVE-2007-1411

Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the 1 mssqlconnect and 2 mssqlpconnect functions...

青果教务系统 /xsweb/pub/temp.aspx nj参数SQL注入漏洞

存在漏洞的文件：/xsweb/pub/temp.aspx?type=ajax&fellowXh=wooyun 该系统有waf的防御，只需要使用--tamper参数即可绕过，继续注入 sqlmap.py -u "http://stu.gxufe.cn/xsweb/pub/temp.aspx?type=menu&nj=wooyun" --tamper "equaltolike.py" --dbms mssql...

泛微 e-Weaver系统自定义SQL语句执行

名称：e-cology 泛微协同商务系统 === --- 测试发现，该商务系统邮件附件下载处存在： ①未授权访问漏洞（无需登录即可遍历下载内部邮件附件） ②SQL注入漏洞 问题链接：http://www.target.com//weaver/weaver.email.FileDownloadLocation?fileid=附件ID&download=1 0x01: 未授权访问 说明：访问问题链接，显示为空白页；遍历附件ID值，如存在附件可直接下载导致内部信息泄露。该漏洞不是重点，SO 简单带过就 OK。...

MSSQL Login Utility

This module simply queries the MSSQL instance for a specific user/pass default is sa with blank. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Potential SQL injection vector using null byte for PDO (MsSql, SQLite)

More info at https://framework.zend.com/security/advisory/ZF2015-08...

某行政审批系统三处系统越权

简要描述： 某行政审批系统三处系统越权 详细说明： 系统开发厂商：邯郸市连邦软件发展有限公司 系统架构：ASPX+MSSQL 关键字：inurl：workplate 部分政府案例： 日照市网上审批系统 http://.../workplate/ 保定市网上审批系统 http://.../workplate/ 磁县网上审批系统 http://.../workplate/ 魏县网上审批系统 http://.../workplate/ 邯郸县网上审批系统 http://.../workplate/ 南郊区网上审批系统 http://...:8001/workplate/ 城区网上审批系统...

Lansweeper Credential Collector

Lansweeper stores the credentials it uses to scan the computers in its Microsoft SQL database. The passwords are XTea-encrypted with a 68 character long key, in which the first 8 characters are stored with the password in the database and the other 60 is static. Lansweeper, by default, creates an...

某在线培训系统Base64编码后通用SQL盲注漏洞

简要描述： RT 详细说明： 接上一个洞： WooYun: 某在线培训系统通用SQL注入漏洞 厂商：上海天柏信息科技有限公司 http://www.timber2005.com/Productsy.html （客户案例及试用） 天柏在线培训系统（网校版） 漏洞地址： http://px2.timber2005.com/WebPage/kccontent.aspx?tid=NDAyMA==&cid=Mjk= 参数cid存在注入 tid和cid都采用了base64的编码，因此提交的时候需要对参数进行编码 提交： 29 and 1=1 编码后： MjkgYW5kIDE9MQ== 页面正常...