dp_crypto

dpcrypto Base64-based encryption oracle exploit for CVE-2017-9248 Telerik UI for ASP.NET AJAX dialog handler Published on exploit-db Update 2020 - Please note that the version on exploit-db is now very out of date compared to the latest version here on GitHub...

CVE-2019-17662

CVE-2019-17662 修改了CVE代码 使用了 Prepared Requests，因为 python3 requests 模块会规范化URL中的 ../，例如： 代码如下： root@kitploit: r = requests.get"http://123.123.123.123/../../../../../../test" printstrr.statuscode 结果如下： root@kitploit: GET /test HTTP/1.1 Host: 123.123.123.123 Connection: close Accept-Encoding: gzip,...

forbidden

Forbidden 4xx HTTPレスポンスステータスコードなどをバイパスします。 このツールはPython Requests、PycURL、およびHTTP Clientに基づいています。 Kali Linux v2024.2 64-bitでテスト済みです。 教育目的で作成されました。お役に立てれば幸いです！ 今後の計画: コンソール出力を抑制するsilentオプションの追加。 色付きコンソール出力を無効にするno colorオプションの追加。 hop-by-hop HTTPリクエストヘッダーのテスト追加。 User-Agent HTTPリクエストヘッダーのテスト追加。...

Sharepoint-cve-2023-29375-incident-response

SOC 事件分析：Microsoft SharePoint Server 特权提升（CVE-2023-29375） 深入安全调查了一次针对 Microsoft SharePoint 服务器的关键漏洞利用和枚举尝试。 事件概述 告警名称： SOC227 - Microsoft SharePoint Server 特权提升 - 可能的 CVE-2023-29375 漏洞利用 严重性： 严重 日期/时间： 2023年10月6日 20:05 目标主机名： MS-SharePointServer 目标 IP / 端口： 172.16.17.233:443（HTTPS） 源 IP（攻击者）：...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

CVE-2024-21644-Poc

CVE-2024-21644的poc 安装模块： pip install requests pip.install colorama...

CVE-2022-22947

CVE-2022-22947 Exp このバグは毎回再現するわけではないようです。 python3 requests...

exploit-writing-for-oswe

OSWE 漏洞利用编写 背景 是什么 本仓库包含一系列与在 OSWE 实验室和认证考试中编写漏洞利用脚本相关的实用代码片段和技巧。 这里的一些示例可能违背某些编码实践，但我们的最终目标是快速且正确地编写漏洞利用脚本。 如果你对使用 requests 库不熟悉，或者刚刚接触 Python，那么 代码片段 部分是一个很好的起点。否则，可以直接跳到 可复用代码 部分或 技巧 部分。 为什么 虽然关于该认证有很多 write-up、评测和笔记，但专门关注漏洞利用编写过程的资源却很少。 编写漏洞利用脚本可能令人生畏，尤其是对于 Python 新手或缺乏通过代码与 Web 应用交互经验的人来说。...

POC-CVE-2023-32681

CVE-2023-32681 の POC これは CVE-2023-32681 の Python 3 実装であり、requests バージョン 2.30.0 以下を使用するクライアントに影響を与えます。 https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4 に従い、サーバーが 3xx リダイレクトを発行する場合、ユーザーエージェントはリクエストを変更し、特定のヘッダーとフィールドをリクエストから削除する必要があります。 これらのフィールドの詳細は...

Exploit for CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/s...

EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2623)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2563)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

EulerOS 2.0 SP15 : python-requests (EulerOS-SA-2026-2465)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

GHSA-6H9P-93HQ-Q7H6 PraisonAI: SpiderTools redirect-target SSRF protection bypass

SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrapepage validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...

EulerOS Virtualization 2.13.0 : python-requests (EulerOS-SA-2026-2417)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

EulerOS Virtualization 2.13.1 : python-requests (EulerOS-SA-2026-2388)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

openSUSE 16 Security Update : python-requests (openSUSE-SU-2026:20926-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20926-1 advisory. This update for python-requests fixes the following issue: - CVE-2026-25645: extractzippedpaths uses predictable filenames when extracting files from zi...

EulerOS 2.0 SP13 : python-requests (EulerOS-SA-2026-2313)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

EulerOS 2.0 SP13 : python-requests (EulerOS-SA-2026-2356)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...