MITM_Intercept

MITMIntercept 一种稍微不那么笨拙的方式，通过Burp等工具拦截和修改非HTTP协议，并支持SSL和TLS拦截。 本工具面向研究人员和应用程序渗透测试人员，用于执行厚客户端安全评估。 这是出色的 mitmrelay 项目的改进版本。 故事 作为 CyberArk Labs 研究部门工作的一部分，我们需要一种方法来检查 TCP 上的 SSL 和 TLS 通信，并能够实时修改数据包内容。有很多方法可以做到这一点（例如，知名的 Burp Suite 扩展 NoPE），但在某些情况下，它们都对我们不起作用。最后我们偶然发现了 mitmrelay。 mitmrelay...

TCASVS

OWASP 富客户端应用安全验证标准 TCASVS 简介 OWASP 富客户端应用安全验证标准（TCASVS）提供了全面的安全要求，用于设计、构建和测试富客户端应用程序——包括桌面软件、原生应用程序，以及在浏览器沙箱之外本地执行的其他程序。 TCASVS 填补了面向 Web 应用的 OWASP 应用安全验证标准 ASVS 与 移动应用安全验证标准 MASVS 之间的空白。虽然 MASVS 也可用于富客户端测试，但并非理想之选。TCASVS 为富客户端场景专门打造了一套标准。 最新稳定版本 — 5.0.0 该标准的源文件位于 文件夹中。包含 6 个章节，涵盖 130...

CVE-2023-23397

CVE-2023-23397 PoC simple y sucio de la vulnerabilidad CVE-2023-23397 que afecta al cliente pesado de Outlook. Descripción Outlook sufre de una falta de control sobre la entrada del usuario que permite configurar el sonido de una reunión y recordatorio de cita. De hecho, un atacante puede forzar ...

Thick-Client-Pentest-Checklist

LISTA DE VERIFICACIÓN DE PENTESTING DE CLIENTES GRUESOS Lista de verificación basada en OWASP 🌟🌟 Más de 80 casos de prueba 🚀🚀 Enlace de Notion: https://hariprasaanth.notion.site/THICK-CLIENT-PENTESTING-CHECKLIST-35c6803f26eb4c9d89ba7f5fdc901fb0 RECOPILACIÓN DE INFORMACIÓN Recopilación de...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

PT-2025-2738 · Infoblox · Infoblox Bloxone

Name of the Vulnerable Software and Affected Versions: Infoblox BloxOne version 2.4 Description: A business logic flaw was discovered due to thick client vulnerabilities. Recommendations: For Infoblox BloxOne version 2.4, consider restricting access to the thick client until a patch is available...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2024-46505

CVE-2024-46505 affects Infoblox BloxOne v2.4. The vulnerability is described as a business logic flaw arising from thick-client vulnerabilities in the product. The CVSS v3.1 vector indicates high impact with critical severity (Network attack, no privileges, no user interaction required for exploi...

CVE-2024-46505

Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities...

CVE-2023-49312

Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...

CVE-2023-49312

Precision Bridge PrecisionBridge.exe aka the thick client before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address...

NCH Express Invoice 7.25 Cleartext Password

Exploit Title: NCH Express Invoice - Clear Text Password Storage and Account Takeover Google Dork:: intitle:ExpressInvoice - Login Date: 07/Apr/2020 Exploit Author: Tejas Nitin Pingulkar https://cvewalkthrough.com/ Vendor Homepage: https://www.nchsoftware.com/ Software Link:...

ERS Data System 1.8.1 - Java Deserialization Exploit

Exploit for windows platform in category remote exploits Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0...

ERS Data System 1.8.1 Java Deserialization

Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on: Windows 7 x86 CVE : CVE-2017-14702 Description: E...

ERS Data System 1.8.1 - Java Deserialization

ERS Data System 1.8.1 - Java Deserialization Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on:...

ERS Data System 1.8.1 - Java Deserialization

Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on: Windows 7 x86 CVE : CVE-2017-14702 Description: E...

Grid. Система распределенных вычислений.

Введение. Материал появился в результате анализа замечаний и предложений, поступивших от тех, кто прочитал статью “Процесс создания ПО для распределенных вычислений C++”. Отсутствие явного распределения задачи сервером между клиентами и отсутствие конкретной задачи в принципе заставили автора ина...

Project Server 2003 - Credential Disclosure

============================================================== Project Server 2003 - Credential Disclosure [email protected] ============================================================== Microsoft Project server 2003 implements a thick client for some of the functionality. The...