SMTPTester

SMTPTester SMTPTesterは、SMTPサーバーを3つの一般的な脆弱性についてテストするPython3ツールです: スプーフィング - 内部ユーザーになりすましてメールを送信する能力 リレー - このSMTPサーバーを使用して組織外の他のアドレスにメールを送信すること ユーザー列挙 - SMTP VRFYコマンドを使用して、特定のユーザー名やメールアドレスが組織内に存在するかどうかを確認する 使い方 まず、必要な依存関係をインストールします: root@kitploit: pip install -r requirements.txt...

CVE-2023-51764

PoC for CVE-2023-51764 SMTP SMUGGLING Postfix CVE-2023-5176525.py 描述 此脚本允许使用邮件服务器的25端口发送消息。 使用 在运行之前，需要修改以下变量： smtpserver - 邮件服务器地址 fromaddress - 第一封邮件的发件人 toaddress - 第一封邮件的收件人 username - 用于通过认证的登录名 password - 用于通过认证的密码 body - 消息内容 消息正文中有两个变量 mail FROM - 虚假发件人地址 rcpt TO - 实际收件人地址...

Network-Analysis-Tools

Pcapキャプチャファイル分析ツールv.1 root@kitploit: !連絡先! | メール: [email protected] | | Github: github/azizaltuntas | | Twitter: @esccopyright | 機能 root@kitploit: 1-訪問サイトトップ10 2-メールアドレス 3-全リクエストURL 4-ユーザーエージェントリスト 5-文字列Grepモード 6-接続詳細 7-使用ポート 8-全IPリスト 9-手動パケットフィルター 10-SMTP解析 11-Web攻撃検出 インストールモジュール...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

MailRipV2

Mail.Rip V2.1337 メールパスコンボリスト用のSMTPチェッカー / SMTPクラッカー。プロキシサポート（SOCKS4 / SOCKS5）、自動プロキシスクレイパーとチェッカー、メール配信 / 受信トレイチェック、未知のSMTPホストのDNSルックアップなどの機能を備えています。簡単に使用でき、常に動作するように作られています！ 概要 法的注意事項 以下のコードは教育目的でのみ使用することが許可されています！ Mail.Rip...

CVE-2020-7247-reproducer

CVE-2020-7247 OpenSMTPD Información Este repositorio contiene los archivos necesarios para construir una imagen de Docker que contiene un entorno vulnerable de OpenSMTPD 6.6.1p1. La vulnerabilidad permite a un atacante ejecutar comandos arbitrarios a través de una sesión SMTP especialmente...

ssrf-king

🔥 ssrf-king 🔥 v1.12 Latest SSRF plugin for burp that Automates SSRF Detection in all of the Request If you are facing any problems or would like a new feature that is not listed below Please create a new issue below in this form Create New Issue Upcoming Features Checklist ✔️ It will soon have a...

CVE-2026-73570

CVE-2026-73570 CVE-2026-73570 PoC 更多 root@kitploit: echo 'EHLO mx-test.invalid MAIL FROM: RCPT TO: QUIT\r\n' | nc 127.0.0.1 587...

CVE-2026-82853

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol SMTP commands due to improper sanitization of carriage return and line feed characters in the transport name option. This can lead to email spoofing and phishing attacks...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

CVE-2026-33604

A flaw was found in Dovecot. A remote attacker can exploit this by crafting a message with a specific line ending. If Dovecot relays this message, it can bypass security protections, allowing the attacker to inject spoofed email into a vulnerable downstream mail server. This vulnerability is...

CVE-2026-77351

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-77352

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-77351

Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...

CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

EUVD-2026-68884

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...