Hack-The-Box-Enigma-Findings-Report

🛡️ Hack The Box - Enigma 发现报告 📋 概述 此仓库包含针对 Hack The Box 机器 Enigma 的全面渗透测试报告。 🔍 主要发现 不安全的 NFS 共享暴露入职文档 - 中等级别 通过未加密电子邮件内容泄露内部凭据 - 中等级别 员工 IMAPS 账户之间重复使用密码 - 高风险级别 OpenSTAManager 经过身份验证的操作系统命令注入 CVE-2025-69212 - 严重级别 Web 应用配置中的明文数据库凭据 - 中等级别 弱用户密码导致离线哈希破解 - 高风险级别 OliveTin 未经身份验证的根自动化 - 参数类型命令注入 -...

megaquagga-pentest-report

megaquagga-pentest-report 黑盒渗透测试 — WordPress漏洞利用，通过CVE-2022-0847进行权限提升...

dvwa-rce-finding-chain

DVWA Finding Chain: Stored XSS to Persistent RCE A pentes...

web-vuln-scanner

Web Vulnerability Scanner Basic web application vulnerability...

High school student rickrolls entire school district, and gets praised

A student at a high school in Cook County successfully hacked into the Internet-of-Things IoT devices of one of the largest school districts in Illinois, and gave everyone a surprise. Minh aka @WhiteHoodHacker on Twitter who attends Elk Grove—a name that curiously resembles the home town of...

KeystoneJS 4.0.0-beta.5 Unauthenticated Stored Cross Site Scripting

Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15878 Vendor Description...

KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection

Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15879 Vendor...

KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vulnerability

KeystoneJS version 4.0.0-beta.5 suffers from an unauthenticated CSV injection vulnerability in admin/server/api/download.js and lib/list/getCSVData.js Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contac...

KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting

Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15878 Vendor Description...

KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection

KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS...

KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection

Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection Vendor Homepage: http://keystonejs.com/ Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: WEBAPPS Platform: Node.js CVE: CVE-2017-15879 Vendor...

PageKit 1.0.10 Password Reset

Exploit Title: Remote PageKit Password Reset Vulnerability Date:a21-01-2017 Software Link: http://pagekit.com/ Exploit Author: Saurabh Banawar from SecureLayer7a Contact: http://twitter.com/asecurelayer7 Website: httpas://securelayer7.neta Category: webapps 1. Description Anyremote user can reset...

PageKit 1.0.10 - Password Reset Exploit

Exploit for php platform in category web applications Exploit Title: Remote PageKit Password Reset Vulnerability Date:​21-01-2017 Software Link: http://pagekit.com/ Exploit Author: Saurabh Banawar from SecureLayer7​ Contact: http://twitter.com/​securelayer7 Website: http​s://securelayer7.net​...

PageKit 1.0.10 - Password Reset

PageKit 1.0.10 - Password Reset Exploit Title: Remote PageKit Password Reset Vulnerability Date:​21-01-2017 Software Link: http://pagekit.com/ Exploit Author: Saurabh Banawar from SecureLayer7​ Contact: http://twitter.com/​securelayer7 Website: http​s://securelayer7.net​ Category: webapps 1...

PageKit 1.0.10 - Password Reset

Exploit Title: Remote PageKit Password Reset Vulnerability Date:21-01-2017 Software Link: http://pagekit.com/ Exploit Author: Saurabh Banawar from SecureLayer7 Contact: http://twitter.com/securelayer7 Website: https://securelayer7.net Category: webapps 1. Description Anyremote user can reset the...