CVE-2013-1965

CVE-2013-1965 A proof of concept exploit for the CVE-2013-1965 vulnerability affecting Apache Struts 2...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repository contains a Proof of Concept PoC script demonstrating the Remote Code Execution RCE vulnerability identified as CVE-2017-5638 in Apache Struts 2. Vulnerability Details CVE ID: CVE-2017-5638 Affected Software: Apache Struts 2 versio...

docker-lab-cve-2017-5638-cve-2021-41773

Attacker Lab: CVE-2017-5638 & CVE-2021-41773 A 7-host Docker-based attack emulation lab designed to demonstrate a multi-stage kill chain, lateral movement, and multi-point IDS detection. Overview This lab simulates a realistic network environment where an attacker progresses from initial...

CVE-2018-1335-EXP-GUI

CVE-2018-1335 GUI Version EXP...

CVE-2020-17530

CVE-2020-17530 s2-061 poc:...

CVE-2024-53677-Docker

CVE-2024-53677 - Apache Struts 2 Remote Code Execution Vulnerability RCE Reproduction Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal and allows for arbitrary code executio...

cve-2023-50164

CVE-2023-50164 Vulnerable versions Struts 2.0.0 - Struts 2.3.37 EOL Struts 2.5.0 - Struts 2.5.32 Struts 6.0.0 - Struts 6.3.0 Versions where the vulnerability is fixed Struts 2.5.33 Struts 6.3.0.2 Search Script Windows/PowerShell For PowerShell 5.1 and newer. Written by Kjetil Sigvartsen at Norsk...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

struts2-jakarta-inject

POC Exploit for CVE-2017-5638 Only use this exploit on systems you own or have explicit rights to test Installation If you have go already installed on your computer, go get is the way to go go get github.com/Greynad/struts2-jakarta-inject Usage Single command execution struts2-jakarta-inject -u ...

CVE-2014-0094

CVE-2014-0094 For verification. Refer to https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 reproduced. The classLoader is working, but the crucial log is percent-encoded, so it does not lead to RCE Windows version also added but only 7u191...

CVE-2017-5638

CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...

CVE-2017-9805

Test nuclei CVE-2017-9805.yaml - struts2 showcase RCE Build Dockerfile docker build -t cve-2017-9805 . Start and detach container docker run --name cve-2017-9805 -p 127.0.0.1:8080:8080 -dit cve-2017-9805 /bin/bash Login to running container docker exec -it cve-2017-9805 /bin/bash Start tomcat...

CVE-2024-53677

CVE-2024-53677 - Apache Struts 2 Root Cause Analysis Lab Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal through the file upload functionality in Struts 2. Source This lab...

web-application-firewall-

Web Application Firewall シミュレーション 概要 このプロジェクトは、FlaskとCVE-2017-5638用の脆弱性チェッカーを使用したWeb Application Firewall（WAF）シミュレーションを示しています。WAFミドルウェアは特定のパターンを含むHTTPリクエストをブロックし、脆弱性チェッカーはApache Struts 2の脆弱性（CVE-2017-5638）をテストして悪用します。 コンポーネント server.py:...

Struts2Vuln

脆弱なStruts2アプリケーション 必要条件 1. Maven https://maven.apache.org 2. Struts = 2.5.10 CVE-2017-5638 - Apache Struts 2 マルチパートフォーム RCE 必要条件 1. マルチパートフォームのPOSTを発行するURLを見つける はじめに 1. アプリケーション/サーバーは以下のmavenコマンドで起動できます: mvn jetty:run. 2. 次のURL http://localhost:8080/fileupload に対してエクスプロイト...

CVE-2017-5638-ApacheStruts2.3.5

CVE-2017-5638-ApacheStruts2.3.5 A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10 Requirements optparse, requests Usage This exploit can be used like this: root@kitploit: $ python3 CVE-2017-5638ApacheStruts.py -u...

CVE-2017-5638

CVE-2017-5638 CVE-2017-5638 Apache Struts2 RCE Exploit 🛠️ Description This is a simple Python-based PoC for CVE-2017-5638 — a Remote Code Execution vulnerability in Apache Struts 2. ⚠️ Disclaimer This code is provided for educational purposes only. Do NOT use it on any system without explicit...

CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Apache Struts 2 S2-052 üzerindeki XStream deserialization zafiyetine yönelik teknik detayları ve PoC Proof of Concept çalışmasını içermektedir. 📌 Zafiyet Bilgileri CVE Kodu: CVE-2017-9805 Zafiyet Türü: Uzaktan Kod Çalıştırma RCE Risk...

St2-052

S2-052 POC Testing Original title: Tomcat Deploying war Original article: http://blog.csdn.net/caiqiiqi/article/details/77861477 Download the last affected version struts-2.5.12 from the Struts2 official website: http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip Note that you on...

st2-048

St2-048 Remote Code Execution Vulnerability Apache Struts 2 possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 2.3.x series http://struts.apache.org/docs/s2-048.html https://cwiki.apache.org/confluence/display/WW/S2-048 Use-Age: root@kitploit: python St2-048.py s...