225515 matches found
WMIExec
WMIexec WMI 프로토콜을 통해 다양한 방식으로 명령 실행을 수행하는 Python 스크립트 세트입니다. 블로그 게시물 https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ 사용법 wmiexecscheduledjob.py 원격 WMI 인스턴스에 인증하고 예약 작업을 통해 명령을 실행하는 Python 스크립트입니다. 스크립트 실행 방법: python3 wmiexecscheduledjob.py -i -u -p -c...
CVE-2021-40845
CVE-2021-40845 I. 취약점 AlphaWeb XE - 인증된 안전하지 않은 파일 업로드로 인한 RCE II. CVE 참조 CVE-2021-40845 III. 벤더 https://www.zenitel.com/ IV. 설명 Zenitel AlphaCom XE Audio Server 11.2.3.10까지의 웹 파트인 AlphaWeb XE는 php/index.php의 Custom Scripts 섹션에서 파일 업로드를 제한하지 않습니다. 업로드된 파일의 내용이나 확장자가 확인되지 않아 /cmd/ 디렉토리에서 PHP 코드 실행...
Malicious code in mfasolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...
mimic
mimic mimic is a tool for covert execution on Linux x8664. What is "covert execution"? Covert execution is the art of hiding a process. In this case, mimic hides the process in plain sight. mimic can launch any program and make it look like any other program. Any user can use it. It does not...
exphub
Notice 결국 각 취약점마다 개별 스크립트를 보관하는 것이 매우 불편하다고 생각해서, 모든 poc와 exp 스크립트를 한곳에 통합하고 원클릭 스캔+취약점 이용이 가능하도록 했습니다. 최근에는 통합 작업에 집중하느라 exphub는 오랫동안 업데이트가 없었지만, 현재 통합 버전이 거의 완성되어 10월연휴 후에 출시될 예정이니 많은 관심 부탁드립니다 이미 출시됨 --- https://github.com/zhzyker/vulmap Exphub Exphub취약점 이용 스크립트 라이브러리 star⭐ 받고 싶어요 현재 Webloigc,...
msidump
msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...
capture-the-flag
Capture The Flag! Linux Live CD イメージをリマスターして、悪用可能な脆弱性が 事前に組み込まれた、すぐに使用できるセキュリティウォーゲームを作成します。 要件 このプロジェクトのスクリプトを使って Live CD をビルドするには、以下が必要です。 sudo を使用した root アクセス権を持つ Linux git make, gcc -- 脆弱性のあるプログラムをビルドするため pwgen -- ランダムなパスワードを生成するため rsync genisoimage -- mkisofs のため advancecomp -- advdef のため...
python-pentesting
침투 테스터를 위한 Python 개요 침투 테스트 및 레드팀 작업을 위한 Python 사용법을 시작하는 것은 상당히 쉽습니다! 이 저장소는 시작하는 데 도움이 되는 몇 가지 무작위 스크립트 모음입니다. 제공: 예제: Mike Felch @ustayready 및 Joff Thyer @joffthyer 제공 이 코드는 순수하게 교육 목적으로 제공됩니다. pivotwinrm.py: Python과 WinRM을 사용하여 원격 머신에서 명령을 실행하는 방법을 보여줍니다 cloudawss3.py: AWS S3 버킷에서 민감한 파일 이름을...
awesome-oneliner-bugbounty
Awesome One-liner Bug Bounty 特にバグバウンティ向けの素晴らしいワンライナースクリプト集 このリポジトリは、私が提供したものやコミュニティから寄稿された、バグバウンティ向けの様々なワンライナーのヒントを保管・公開しています。あなたのコントリビューションや提案を心から歓迎します♥。 定義 このセクションでは、ワンラインのコマンド/スクリプト全体で使用される特定の用語やプレースホルダーを定義します。 1.1. "HOST "...
htrace.sh
Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...
Jeesns 1.4.2 - Cross-Site Scripting
Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /weibo/topic component and allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. id: CVE-2020-19295 info: name: Jeesns 1.4.2 - Cross-Site Scripting author:...
Rukovoditel <= 2.7.2 - Cross Site Scripting
A stored cross site scripting XSS vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter. id: CVE-2020-35984 info: name: Rukovoditel = 2.7.2 - Cross Site...
Xinuo Openserver 5/6 - Cross-Site scripting
Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...
UpdraftPlus < 1.22.9 - Cross-Site Scripting
The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...
Rukovoditel <= 3.2.1 - Cross Site Scripting
A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...
Rukovoditel <= 3.2.1 - Cross Site Scripting
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking...
BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting
BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML. id: CVE-2018-16139 info: name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting author:...
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. id: CVE-2022-45037 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...
Rukovoditel <= 3.2.1 - Cross Site Scripting
A stored cross-site scripting XSS vulnerability in the Global Entities feature /index.php?module=entities/entities of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity"...