cve-2020-5260

cve-2020-5260 نقطة نهاية PoC HTTP لـ cve-2020-5260 يمكن نشرها على Heroku معلومات الإسناد Felix Wilhelm من Google Project Zero https://bugs.chromium.org/p/project-zero/issues/detail?id=2021 تشغيل الثغرة root@kitploit: git clone...

CVE-2020-5260

CVE-2020-5260 CVE-2020-5260 प्रदर्शन रिकॉर्ड जब git git clone https://example.com जैसे कमांड को निष्पादित करता है, तो यह प्रोटोकॉल "https" का उपयोग करके होस्ट "example.com" के क्रेडेंशियल्स को संग्रहीत करने का अनुरोध करता है, और जब रिमोट एंड प्रमाणीकरण का अनुरोध करता है तो लौटाए गए क्रेडेंशियल्स ...

CVE-2024-30043-XXE

CVE-2024-30043-XXE श्रेय वर्तमान में इस भेद्यता का प्रभाव सीमित है, लेकिन एक चतुर बाइपास विचार प्रदान करने के लिए https://x.com/chudyPB का धन्यवाद। https://x.com/chudyPB...

Airachnid-Burp-Extension

امتداد Burp لخداع ذاكرة التخزين المؤقت للويب امتداد Burp لاختبار التطبيقات للضعف أمام هجوم خداع ذاكرة التخزين المؤقت للويب. بمجرد تحميل الامتداد، يمكن الوصول إليه في علامة التبويب Target - Sitemap والنقر بالزر الأيمن على المورد الذي يجب اختباره. سيظهر عنصر قائمة سياقي يسمى "Web Cache Deception...

Zeus-Scanner

Annuaire des liens utiles Qu'estce que Zeus Les caractéristiques de Zeus Exigences et installation Ubuntu/Debian centOS autre Capturesécran vidéo Demo manuel d'utilisation Comment fonctionne Zeus Fonctionnalité Passant drapeaux sqlmap avec Zeus Informations légales Licence GPL Code de conduite...

bypass-url-parser

Bypass Url Parser Strumento che testa MOLTI bypass di URL per raggiungere una pagina protetta 40X. Se ti stai chiedendo perché questo codice non è nient'altro che un wrapper sporco di curl, ecco il motivo: La maggior parte delle richieste Python fa encoding/decoding di url/path/parametri, e lo...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — Guida a CVE-2024-21413 Una guida completa alla room TryHackMe "Moniker Link": sfruttare la CVE-2024-21413, una vulnerabilità di Microsoft Outlook del 2024, per rubare l'hash NTLMv2 della vittima nel momento in cui fa clic su un link in un'email di phishing — senza macro,...

CVE-2026-82247

CVE-2026-82247 affects the gix-url crate (≤ 0.32.0) within the gitoxide Rust library. Its hand-rolled URL parser fails to treat ? or # as authority terminators per RFC 3986 , causing gix-transport 's HTTP redirect identity guard (can_reuse_identity) to compare the wrong host and fail open . An at...

CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

CVE-2024-22243

CVE-2024-22243 Autore: Sean Pesce Questo progetto contiene un'applicazione web di esempio che dimostra scenari sfruttabili per CVE-2024-22243, una vulnerabilità di parsing degli URL nel framework Java Spring Framework divulgazione ufficiale qui. Vulnerabilità Le versioni affette di Spring...

CVE-2023-24329-PoC

CVE-2023-24329-PoC Ein kurzer und informativer PoC zu CVE-2023-24329: Parse-Schwachstelle in Python-urllib. root@kitploit: git clone https://github.com/H4R335HR/CVE-2023-24329-PoC cd CVE-2023-24329-PoC python3 CVE-2023-24329-PoC.py Basierend auf den Recherchen von Yebo Cao -...

poc-proxycommand-vulnerable

RCE via insecure /.ssh/config Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH. Vulnerable config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Note: in my initial assessment I was under the...

CVE-2023-41080

vulnerabile: http://localhost:8081//secret.html;@example.com Reindirizzamento a un sito web arbitrario in questo caso, https://example.com. corretto: http://localhost:8082//secret.html;@example.com rif: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2023-24329-Exploit

Einführung Die URL-Parsing-Funktionen konzentrieren sich darauf, eine URL-Zeichenfolge in ihre Komponenten zu zerlegen oder URL-Komponenten zu einer URL-Zeichenfolge zusammenzusetzen. urllib.parse.urlparse Einfach urllib.parse wird zum Parsen von URLs verwendet, wir können es umgehen, indem wir...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

EUVD-2026-65697

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...

unfurl

unfurl Estrai le parti degli URL forniti su stdin Installazione Se hai Go installato e configurato: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest Altrimenti scarica l'ultimo binario per la tua piattaforma, estrailo e spostalo da qualche parte nel tuo $PATH es. /usr/bin/:...