Ruby HTTP Header Injection

TIMELINE rootredrain submitted a report to Ruby. show raw Jun 22nd Hi, I would like to report a HTTP Header injection vulnerability in 'net/http' that allows attackers to inject arbitrary headers in request even create a new evil request. PoC require 'net/http' http =...

Ruby: Ruby:HTTP Header injection in 'net/http'

Hi, I would like to report a HTTP Header injection vulnerability in 'net/http' that allows attackers to inject arbitrary headers in request even create a new evil request. PoC require 'net/http' http = Net::HTTP.new'192.168.30.214','80' res = http.get"/r.php HTTP/1.1\r\nx-injection: memeda" F1009...

Airia - Arbitrary File Upload

Airia - Arbitrary File Upload Exploit Title: Airia - Webshell Upload Vulnerability Date: 2016-06-20 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: http://ytyng.com Software Link: https://github.com/ytyng/airia/archive/master.zip Version: Latest commit Tested on: Debia...

JMX2 Email Tester - save_email.php Arbitrary File Upload Exploit

Exploit for multiple platform in category web applications Exploit Title: JMX2 Email Tester - Web Shell Uploadsaveemail.php Date: 2016-02-15 Blog: http://www.hahwul.com Vendor Homepage: https://github.com/johnfmorton/jmx2-Email-Tester Software Link:...

Amazon Linux: Security Advisory (ALAS-2015-588)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

YesWiki 0.2 - 'squelette' Directory Traversal

Exploit Title: YESWIKI 0.2 - Path Traversal Date: 2015-09-02 Exploit Author: HaHwul Exploit Author Blog: http://www.codeblack.net Vendor Homepage: http://yeswiki.net Software Link: https://github.com/YesWiki/yeswiki Version: yeswiki 0.2 Tested on: Debian Wheezy CVE : none...

Fedora 22 : golang-1.4.2-3.fc22 (2015-13002)

security fixes for net/http smuggling Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Arris VAP2500 - Authentication Bypass

!/usr/bin/env ruby require 'net/http' require 'digest/md5' if !ARGV0 puts "Usage: $0 " exit0 end host = ARGV0 newpass = "h4x0r3d!" http = Net::HTTP.newhost.start users = nil users = http.requestget"/admin.conf".body.split"\n".map! |user| user.sub/^.?,.$/,"\1" if users puts " found user accounts:...

Alibaba Clone Diamond Version - SQL Injection Vulnerability Exploit

No description provided by source. ----------------------------Information------------------------------------------------ +Name : Alibaba Clone Diamond Version SQL Injection Vulnerability Exploit +Autor : Easy Laster +ICQ : 11-051-551 +Date : 09.05.2010 +Script : Alibaba Clone Diamond Version...

Alibaba Clone <= 3.0 (Special) - SQL Injection Vulnerability Exploit

No description provided by source. ----------------------------Information------------------------------------------------ +Name : Alibaba Clone Version = 3.0 Special SQL Injection Vulnerability Exploit +Autor : Easy Laster +ICQ : 11-051-551 +Date : 09.05.2010 +Script : Alibaba Clone Version 3.0...

ilchClan <= 1.0.5B SQL Injection Vulnerability Exploit

No description provided by source. ----------------------------Information------------------------------------------------ +Name :ilchClan = 1.0.5B SQL Injection Vulnerability Exploit +Autor : Easy Laster +ICQ : 11-051-551 +email : [email protected] +Date : 15.04.2010 +Script : ilchClan = 1.0.5B...

WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability

No description provided by source. !/usr/bin/ruby Exploit Title: WordPress Count per Day 3.2.5 CSRF Google Dork: inurl:/wp-content/plugins/count-per-day Date: 18.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage:...

mygamingladder MGL Combo System <= 7.5 - SQL Injection

No description provided by source. ----------------------------Information------------------------------------------------ +Name : mygamingladder MGL Combo System = 7.5 SQL injection Vulnerability & SQL injection Exploit +Autor : Easy Laster +Date : 10.04.2010 +Script : mygamingladder MGL Combo...

mygamingladder MGL Combo System <= 7.5 game.php SQL injection Exploit

No description provided by source. ----------------------------Information------------------------------------------------ +Name : mygamingladder MGL Combo System = 7.5 game.php SQL injection Exploit +Autor : Easy Laster +Date : 10.10.2010 +Script : mygamingladder MGL Combo System = 7.5 +Price :...

Apache Commons FileUpload and Apache Tomcat Denial of Service

Exploit for multiple platform in category dos / poc CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in evaluating...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

Apache Commons FileUpload and Apache Tomcat - Denial of Service CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in...

Apache Commons FileUpload and Apache Tomcat - Denial of Service

CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in evaluating whether their applications are vulnerable to this...

Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit

Exploit for php platform in category web applications Exploit Title: Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit Google Dork: inurl:regenbogenwiese.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Software Name: Regenbogenwiese v1.5 © 2007 by DieKrabbe...

Woltlab Burning Board Regenbogenwiese 2007 Addon - SQL Injection

Exploit Title: Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit Google Dork: inurl:regenbogenwiese.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Software Name: Regenbogenwiese v1.5 © 2007 by DieKrabbe Version: 1.5 Tested on: Windows 8/Backtrack !/usr/bin/ruby...

KNet Web Server 1.04b - Buffer Overflow SEH Vulnerability

Exploit for windows platform in category remote exploits !/usr/bin/ruby Exploit Title: KNet Web Server Buffer Overflow SEH Date: 2013-03-27 Exploit Author: Myo Soe, http://yehg.net/ Software Link: http://www.softpedia.com/progDownload/KNet-Download-20137.html Version: KNet 1.04b Tested on: Window...