CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 のエクスプロイト 4.0.0 GET /api/index.php/v1/config/application?public=true HTTP/1.1 Host: 10.9.49.205 User-Agent: curl/7.68.0 Accept: / Mark bundle as not supporting multiuse HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 15:14:05 GMT Server: Apache/2.4.41 Ubuntu x-frame-options:...

Dop2Mop

Dop2Mop 一个概念验证的OpenGraph收集器，用于BloodHound，映射从DevOps到MLOps基础设施的攻击路径。 基于Brett Hawkins（@h4wkst3r）的《从DevOps到MLOps基础设施的攻击路径：特权管道》。 目录 致谢 概述 支持的平台 映射的信任边界 安装 可选依赖 快速开始 生成演示数据 导入BloodHound 配置 配置文件 凭据验证 CLI参考 命令概述 全局选项 dop2mop collect dop2mop demo CLI使用示例 基本收集 单一平台收集 多平台收集 GitHub收集示例 Azure DevOps收集示例 Azur...

Eaton-UPS-Companion-Exploit

Resumen El software Eaton UPS Companion busca una actualización cada semana a través de una conexión HTTP insegura y ejecuta eval sobre el contenido de lo que sea que esté en la URL de actualización. Esto permite a un atacante crear una función JavaScript que utiliza las operaciones de bajo nivel...

CVE-2026-40369-EXPLOIT

Full Blog - https://pwn2nimron.com/blog CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation Class 253 Summary Type: Arbitrary kernel write increment — PRIVILEGE ESCALATION PRIMITIVE Component: ntoskrnl.exe — ExpGetProcessInformation Trigger:...

CVE-2018-17463

CVE-2018-17463 完成了一个针对CVE-2018-17463的可工作利用，纯粹为了好玩。 我找到的关于此漏洞的原始文章在此 http://phrack.org/papers/jitexploitation.html。我只是想把这个任意读写变成完整的可利用漏洞。 此外，我还从以下论文中学习了JIT spray技术，这是一篇有趣的读物。 root@kitploit: @inproceedingsgawlik2018sok, title=Sok: Make jit-spray great again, author=Gawlik, Robert and Holz, Thorsten...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

xalgorix

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

xalgorix

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

wpscan

WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...

marfil

Marfil Marfil is an extension of the Aircrack-ng suite, used to assess WiFi network security. It allows to split the work of performing long running dictionary attacks among many computers. Motivation The Aircrack-ng suite provides the aircrack-ng tool, which is a 802.11 WEP and WPA/WPA2-PSK key...

gotestwaf

GoTestWAF GoTestWAF 是一个用于 API 和 OWASP 攻击模拟的工具，支持多种 API 协议，包括 REST、GraphQL、gRPC、SOAP、XMLRPC 以及其他。 它旨在评估 Web 应用程序安全解决方案，例如 API 安全代理、Web 应用防火墙、IPS、API 网关以及其他。 工作原理 要求 Docker 快速开始 检查评估结果 演示 其他运行 GoTestWAF 的选项 配置选项 与 OWASP 核心规则集回归测试套件一起运行 工作原理 GoTestWAF 使用编码后的负载生成恶意请求，这些负载放置在 HTTP 请求的不同部分：请求体、请求头、URL...

bread

🍞 BREAD BREAD BIOS Reverse Engineering & Advanced Debugger is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code on real HW from another PC via serial cable. Introduction BREAD emerged from many failed attempts to reverse engineer legacy BIOS. Given that the vast...

gef

GEF（発音: ʤɛf - "Jeff"）は、x86/64、ARM、MIPS、PowerPC、SPARC向けのコマンド群で、旧来のGDBを使用するエクスプロイト開発者やリバースエンジニアを支援します。Python APIを使用してGDBに追加機能を提供し、動的解析やエクスプロイト開発のプロセスを支援します。アプリケーション開発者にとっても、GEFが通常のGDBの難解さを大幅に解消し、従来のコマンドの繰り返しを避け、デバッグ実行時に関連情報を引き出すため、恩恵があります。 クイックセットアップ まず、GDB...

gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

flareprox

FlareProx 🔥 Rotación simple de IP y redirección de URL mediante Cloudflare Workers FlareProx despliega automáticamente endpoints de proxy HTTP en Cloudflare Workers para redirigir fácilmente todo el tráfico a cualquier URL que especifiques. Soporta todos los métodos HTTP GET, POST, PUT, DELETE,...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

openSIS Student Information System 8.0 SQL Injection

openSIS Student Information System version 8.0 is susceptible to SQL injection via the studentid and TRANSFERSCHOOL parameters in POST request sent to /TransferredOutModal.php. id: CVE-2021-41691 info: name: openSIS Student Information System 8.0 SQL Injection author: Bartu Utku SARP severity: hi...