Rogue-MySql-Server

Rogue-MySql-Server 编辑脚本并根据需要更改要读取的文件和服务器端口。运行脚本并连接到你的服务器，以便从客户端读取文件。 读取 mysql.log 以查看已读取的文件内容。...

Oracle-mysql-CVE-2012-2122

Mysql 認証バイパス脆弱性 CVE-2012-2122 MariaDB/MySQL に接続する際、入力されたパスワードと期待される正しいパスワードが比較されます。不適切な処理により、memcmp が非ゼロを返した場合でも、MySQL は両方のパスワードが同一であると見なします。つまり、ユーザー名さえ分かれば、繰り返し試行することで SQL データベースに直接ログインできます。 影響を受けるバージョン： MariaDB バージョン 5.1.62、5.2.12、5.3.6、5.5.23 は対象外です。 MySQL バージョン 5.1.63、5.5.24、5.6.6 は対象外です。...

quasibot

quasiBot quasiBot 0.3 - 自述 07.08.14 简介 QuasiBot 是一个用 PHP 编写的复杂 Webshell 管理器，它运行在用户自行实现的基于 Web 的后门上。通过使用预先准备好的 PHP 后门，quasiBot 将作为 C&C 尝试与每个后门进行通信。该工具超越了普通的 Web-shell 管理器，因为它提供了用于扫描、利用等有用的功能。它被称为准 HTTP 僵尸网络。此外，quasiBot 允许你对 FTP、SSH 或数据库等服务执行各种暴力破解攻击。 所有关于机器人的数据存储在 SQL 数据库中，目前仅支持 MySQL。还支持 TOR...

Anchor CMS 0.12.3 - Error Log Exposure

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. id: CVE-2018-7251 info: name: Anchor CMS 0.12.3 ...

phpMyAdmin <4.8.5 - Local File Inclusion

phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfi...

vapi

vAPI...

CVE-2020-11579

CVE-2020-11579 简介 PHPKB 9.0 企业版（MySQL 数据库） 存在一个通过恶意 MySQL 服务器触发的未认证任意文件读取漏洞。 远程攻击者只需发送单个 HTTP GET 请求，即可在远程受害主机上以 Web 服务器权限（例如 www-data）读取任意文件。 阅读更多：https://shielder.it/blog/mysql-and-cve-2020-11579-exploitation 说明 该脚本也可以以 server-only mode（仅服务端模式）运行，并提供一个独立的 MySQL 服务器，可用于类似的漏洞利用。 用法 root@kitploit:...

cve-2022-23134-poc-and-writeup

CVE-2022-23134 Writeup 与 POC 这是针对特定版本 Zabbix 中 CVE-2022-23134 的 POC 与 writeup。请阅读 writeup.md 了解利用该漏洞所需的详细信息 - 它确实需要对 MySQL 进行一些配置！...

kurukshetra

Kurukshetra Kurukshetra is a web framework that’s developed with the aim of being the first open source framework which provides a solid foundation to host reasonably complex secure coding challenges while still providing the ability to efficiently and dynamically execute each challenge on the...

hackazon

Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...

VulnNodeApp

VulnNodeApp A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository root@kitploit: git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js...

novahot

novahot novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python. Beyond executing system commands, novahot is able to emulate interactive...

CVE-2023-22884-Airflow-SQLi

PoC de inyección SQL en Apache Airflow CVE-2023-22884 PoC para CVE-2023-22884 es una vulnerabilidad RCE de Apache Airflow que afecta a versiones anteriores a 2.4.0. La descripción del informe oficial dice: Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comand...

enumdb

enumdb Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search fo...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

WebGoat.NET

在提示符下，cd 进入 WebGoat.NET DB 目录 root@kitploit: % cd /WebGoat.NET/DB 启动 mysql 工具，提供拥有创建数据库权限的用户名（如果需要，还需提供密码）。例如，要使用默认的 root 用户： % mysql --user=root 创建 webgoatcoins 数据库并加载模式。（首次加载模式时会显示错误消息，因为它会尝试清空任何已有的表，只需忽略这些消息即可。） mysql create database webgoatcoins; mysql use webgoatcoins; mysql source...

ASST

ASST BETA OWASP ASST Automated Software Security Toolkit | A Novel Open Source Web Security Scanner. Note: AWSS is the older name of ASST Introduction Web applications have become an integral part of everyday life, but many of these applications are deployed with critical vulnerabilities that can...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

cosa-nostra

Cosa Nostra Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. I basically maintain it since 2016 for my one...

mysslstrip

mysslstrip mysslstrip 是一个基于 Python 的概念验证工具，演示了如何对 MySQL 流量进行中间人攻击并剥离 SSL/TLS，对应 CVE-2015-3152。 用法 mysslstrip.py -h -p LISTENPORT -i LISTENINTERFACE dest 示例输出 root@kitploit: root@duo1 python2.7 mysslstrip.py -p 3307 127.0.0.1:3306 2015-04-29 21:33:14+0000 - Log opened. 2015-04-29 21:33:14+0000 -...