MySQL-Fu.rb

MySQL-Fu.rb MySQL-Fu è uno script client MySQL basato su Ruby che ho scritto. Fa la maggior parte delle cose che un normale client MySQL potrebbe fare: shell SQL, aggiornamento/cancellazione/eliminazione di database/tabelle, aggiunta/rimozione di utenti, dump di database/tabelle con opzione per...

HatCloud

HatCloud - interrotto HatCloud creato in Ruby. Consente di bypassare CloudFlare per scoprire l'IP reale. Può essere utile se devi testare il tuo server e il tuo sito web. Testare la tua protezione contro DDoS Denial of Service o DoS. CloudFlare è un servizio di distribuzione di server DNS che si...

eval-stdin

La vulnerabilità PHP eval-stdin.php CVE-2017-9841 è una vulnerabilità RCE nel eval-stdin.php obsoleto. Questo exploit è solo un'automazione per la vulnerabilità menzionata ed è ancora in fase di sviluppo. Scritto in Ruby 3.0.4 in meno di 2 ore, testato su Kali Linux, Arch Linux, Ubuntu minimal e...

CVE-2020-0601-spoofkey

CVE-2020-0601-spoofkey Per vedere come creare una chiave falsa e firmare il codice REQ: openssl, main.rbche ho caricato VISITA : https://twitter.com/exploitblizzard...

yasuo

YASUO @0xsauby Description Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise th...

yasuo

YASUO @0xsauby Descrizione Yasuo è uno script Ruby che scansiona la rete alla ricerca di applicazioni web di terze parti vulnerabili. Durante le valutazioni di sicurezza di rete interne, esterne, red team, ecc., capita spesso di imbattersi in applicazioni web di terze parti vulnerabili o in...

CVE-2019-16405.rb

Questo repository non contiene un README...

CVE-2024-46986

CVE-2024-46986 Camaleon CMS Exploit - Caricamento Arbitrario di File Questo repository contiene uno script Python che automatizza lo sfruttamento di una vulnerabilità di upload file in Camaleon CMS. La vulnerabilità consente a un attaccante di caricare file arbitrari come script Ruby sul server,...

EUVD-2017-16647

Malware in sbrugna...

Exploit for CVE-2010-1485

PoC exploit for CVE-2010-1485, Exploit module/toolkit targeting XXE vulnerability. The target product/service or framework is unspecified, but the tool is designed to automate exploitation of XXE vulnerabilities in various applications. The vulnerability class/vector is XXE XML eXternal Entity. T...

Exploit for Link Following in Rarlab Unrar

A proof of concept for CVE-2022-30333 - a path traversal vulnera...

Exploit for Off-by-one Error in Sudo_Project Sudo

PoC exploit for CVE-2021-3156, an exploit module targeting the WangluoAnquan framework. The exploit is designed to demonstrate the vulnerability in the framework's UploadHandler.ashx component, which allows for arbitrary file uploads. The exploit uses a simple form submission to upload a maliciou...

Exploit for Cross-site Scripting in Tastyigniter

PoC exploit for CVE-2021-38699. The target product/service is Java, and the vulnerability class/vector is XXE XML External Entity injection. The probable entry point is the XXEinjector.rb script, which is a Ruby script that automates the exploitation of XXE vulnerabilities using direct and out of...

h1-ctf: 12 Days of Hacky Holidays write-up, but as a text-based RPG?

The flags are - flag48104912-28b0-494a-9995-a203d1e261e7 - flagb7ebcb75-9100-4f91-8454-cfb9574459f7 - flagb705fb11-fb55-442f-847f-0931be82ed9a - flag972e7072-b1b6-4bf7-b825-a912d3fd38d6 - flag2e6f9bf8-fdbd-483b-8c18-bdf371b2b004 - flag18b130a7-3a79-4c70-b73b-7f23fa95d395 -...

Bludit 3.9.2 - Authentication Bruteforce Mitigation Bypass

!/usr/bin/env ruby Title: Bludit 3.9.2 - Authentication Bruteforce Mitigation Bypass Author: noraj Alexandre ZANNI Author website: https://pwn.by/noraj/ Date: 2020-08-16 Vendor Homepage: https://www.bludit.com/ Software Link: https://github.com/bludit/bludit/archive/3.9.2.tar.gz Version: = 3.9.2...

XXEinjector

This is an exploit module/toolkit targeting XXE XML eXternal Entity vulnerabilities. The primary CVE ID is not explicitly stated, but the tool is designed to automate exploitation of XXE vulnerabilities using direct and out-of-band methods. The target product/service is likely web applications,...

CVE-2018-8780

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script. Mitigation It is possible to test for presence of the NULL byte manually...

Homematic CCU2 2.29.23 Arbitrary File Write

!/usr/bin/ruby Exploit Title: Homematic CCU2 Arbitrary File Write Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE : 2018-7300 Description:...

Homematic CCU2 2.29.23 - Remote Command Execution

!/usr/bin/ruby Exploit Title: Homematic CCU2 Remote Command Execution Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE : 2018-7297 Description:...

Hashicorp vagrant-vmware-fusion 4.0.23 - Local Privilege Escalation

A couple of weeks ago I disclosed a local root privesc in Hashicorp's vagrant-vmware-fusion plugin: https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmw... The initial patch they released was 4.0.21 which unfortunately contained a bug that prevented it from working at all...