0d1n - Tool For Automating Customized Attacks Against Web Applications

Web security tool to make fuzzing at HTTP inputs, made in C with libCurl. You can do: brute force passwords in auth forms directory disclosure use PATH list to brute, and find HTTP status code test list on input to find SQL Injection and XSS vulnerabilities To run: require libcurl-dev or...

Code injection

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

CVE-2015-1229

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

CVE-2015-1229

CVE-2015-1229 : Google Chrome before 41.0.2272.76 fails to properly handle a 407 (Proxy Authentication Required) response that includes a Set-Cookie header, enabling remote proxy servers to perform cookie-injection attacks. The vulnerability affects the net/http/proxy_client_socket.cc path and ca...

Darwin Streaming Server <= 4.1.2 (parse_xml.cgi) Code Execution Exploit

No description provided by source. !/usr/bin/perl QTTS REMOTE ROOT exploit by FOXMULDER [email protected] FOXMULDER PRESENTS foxmulderatabv.bg DarwinOSX4.x? 5.X QTSSQuick Time Stream Server 3.X The bug in Darwin 5.X with unpatched QTSS in parsexml.cgi which lead to remote root compromise: $filenam...

Mohachat 0.1.1 Cross Site Scripting / Redirection

Exploit Title: Mohachat 0.1.1 Cross Site Scripting Vulnerability Mohachat 0.1.1 HTML Form redirecting page Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://mohachat.org Version : 0.1.1 Tested on: Windows Category: webapps Google Dork: intext:"MOHA Chat 0.1.1 S.H.Mohanjith" + Exploit :...

CVE-2013-6634

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...

Session fixation

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...

CVE-2013-6634: Improper Authentication

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...

CVE-2013-6634

The CVE-2013-6634 issue affects Chromium/ chromium-browser prior to version 31.0.1650.63, where OneClickSigninHelper::ShowInfoBarIfPossible used an incorrect URL during realm validation. This allowed session fixation and potential web-session hijacking via a 302 redirect. The documented fixes upg...

CVE-2013-6627

CVE-2013-6627 is an out-of-bounds read in Chromium/Google Chrome’s HTTP parsing (1xx handling). Affected: Chrome/Chromium around 31.x prior to 31.0.1650.48. Exploitation noted in public advisories/Exploits. Remediation: update to Chromium/Chrome 31.0.1650.48 or newer (as reflected in openSUSE Deb...

CVE-2013-2908

Google Chrome before 30.0.1599.66 uses incorrect function calls to determine the values of NavigationEntry objects, which allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code...

CVE-2013-2916

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

Code injection

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

CVE-2013-2916

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

CVE-2013-2916

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

CVE-2013-2916: Undefined Security Weakness

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code, in conjunction with a delay in notifying the user of an attempted spoof...

CVE-2013-2908: Undefined Security Weakness

Google Chrome before 30.0.1599.66 uses incorrect function calls to determine the values of NavigationEntry objects, which allows remote attackers to spoof the address bar via vectors involving a response with a 204 aka No Content status code...

CVE-2013-2873

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources...