pentest-writeups

pentest-writeups Kioptrix Level 1 writeup - CVE-2003-0201 Samba trans2open Kioptrix Level 1 — Penetration Testing Writeup Author: Amirbek Raxmatullayev @americo444 Date: 2026-06-17 Platform: VulnHub Difficulty: Beginner Objective: Gain root access 1. Environment Setup Component| Details ---|---...

CVE-2025-0282

CVE-2025-0282 Ivanti Connect Secure IFT TLS Stack Overflow pre-auth RCE CVE-2025-0282 This is purposefully broken in non-trivial ways and will require effort to work as outlined previously in our exploitation technique blogpost. To understand this vulnerability, you can take a look at our technic...

ropr

ropr ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may...

gaia

Gaia: Global API Integrity Assessor Dependencies Install opam to build the tests API. Install git, python3, pip and .NET to build RESTler and Schemathesis. Install cargo to build Gaia. Install docker v26.0.1 and docker compose v2.26.1 to build Gaia with the ELK Stack optionnal if not. Install nod...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

CVE-2026-98935

A flaw was found in the Linux kernel's Real-Time Clock RTC driver. This information disclosure vulnerability occurs because the driver fails to initialize memory padding within an internal data structure before copying alarm details to user space. A local user can exploit this flaw by querying th...

sqlite-cte-nest

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-cte-nest Write-up: https://abraxaslabs.tech/research/sqlite-cte-nest sqlite-cte-nest Class: Crash Reach: Local SQLite 3.53.4 b09c88c14082339b66c7b7158d609a771e64ca69, SOURCEID 2026-07-24 19:02:57...

CVE-2021-31166

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166 HTTP Protocol Stack vulnerability Suricata rule Zeek Package References https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

nginxpwn

Exploitation Training -- CVE-2013-2028: Nginx Stack Based Buffer Overflow This repository contains the nginx 1.4.0 source code as well as precompiled binaries with and without stack cookies. There's also a Vagrantfile for easy setup. Announcement and patch:...

CVE-2013-3664_MAC

Sketchup MAC Pict Material Palette Stack Corruption - CVE-2013-3664 SketchUp fails to validate the input when parsing an embedded MACPict texture. Arbitrary code execution is proved possible after a malicious texture or thumbnail or background image triggers a stack overflow. The issue can also b...

boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

CVE-2022-21907

CVE-2022-21907 - HTTP Protocol Stack Remote Code Execution Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author NU11SECURITY and michelep Description: HTTP Protocol Stack Remote Code Execution...

looneyCVE

Step 1 Check the glibc version ldd --version Check if a machine is vulnerable to Looney Tunables CVE-2023-4911 env -i "GLIBCTUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=printf '%08192x' 1" /usr/bin/su --help If we get a Segmentation fault core dumped, then machine is vulnerable. Step 2...

CVE-2025-32756-POC

CVE-2025-32756: Fortinet RCE PoC A proof-of-concept for the critical stack-based buffer overflow vulnerability CVE-2025-32756 affecting Fortinet products. Vulnerability CVSS : 9.8 Critical Type : Stack-based buffer overflow in AuthHash cookie processing Impact : Unauthenticated remote code...

misfortune-cookie

CVE-2014-9222 "Misfortune Cookie" PoC suite Stack overflow in AllegroSoft RomPager's HTTP cookie handling all versions 4.34. A single unauthenticated request with a crafted Cookie: header corrupts memory. Effects: admin auth bypass, DoS/reboot, and with firmware-specific offsets remote code...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

CVE-2026-117557

A flaw was found in SDLimage. By tricking a user or application into processing a specially crafted Interleaved Bitmap ILBM image file, an attacker can trigger an out-of-bounds read condition during image decoding. This can lead to a Denial of Service DoS by causing the application to crash, or...

CVE-2022-30040

Tenda AX1803 v1.0.0.12890 Denial-of-service Vulnerability Overview Manufacturer's website infomation: https://www.tenda.com.cn/profile/contact.html Firmware download address: https://www.tenda.com.cn/download/default.html Vulnerability description The vulnerability lies in rootfs In / goform /...

-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318

-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318 Device: vivo Y200i PD2354C, Snapdragon 4 Gen 2 SM4450, Android 14 / OriginOS 4 Kernel: 5.10.218-gki-g3a51ea9d5834 39-bit VA, 4K pages, KASLR on, STACKLEAK=y, no SVE Goal: temporary root via CVE-2026-43499 GhostLoc...

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...