2371 matches found
ASPX_WebShell_COFFLoader
ASPX Web Shell with COFF Loader Based on TrustedSec's CSCOFFLoader Description This ASPX web shell enables execution of Beacon Object Files BOFs on a target server using a semi-interactive Python client. It leverages a COFF loader implementation derived from TrustedSec’s CSCOFFLoader. This projec...
wsh
wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...
CVE-2024-40110
CVE-2024-40110 - Poultry Farm Management System v1.0 Exploit para Poultry Farm Management System v1.0 Após encontrar um exploit no site Exploit-DB e o mesmo não funcionar, decidi realizar uma revisão no código e aprimorá-lo para adequar a necessidade. Uma vez que funcionou, decidi então, melhorar...
CVE-2025-0282-Ivanti-exploit
CVE-2025-0282-Ivanti-exploit CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution RCE through a buffer overflow exploit. This vulnerability enables attackers to upload malicious files e.g., web shells and execute commands on the target system...
joro
Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...
Chamilo-CVE-2023-4220-Exploit
Chamilo-LMS-CVE-2023-4220-Exploit This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24, and Attackers can obtain remote code execution via uploading of web...
PHP-Shell-Detector
Web Shell Detector Web Shell Detector – is a php script that helps you find and identify php/cgiperl/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%. By using the latest javascript and css technologies, web shell detector has ...
zip-shotgun
ZIP Shotgun 用于测试 zip 文件上传功能（以及可能的 zip 文件提取）是否存在漏洞（即 Zip Slip）的实用脚本。 该脚本的思路来自 Silent Signal Techblog - 压缩文件上传与命令执行 以及 OWASP - 测试恶意文件上传 Snyk.io 有一份关于此漏洞的报告：Zip Slip 漏洞，以及一个包含多种语言存在漏洞的库的 GitHub 仓库：Snyk.io Zip Slip GitHub 仓库 还有来自 LiveOverflow 的一个精彩视频，对 Zip Slip 和 Zipperdown 漏洞进行了阐述：危险 .zip 漏洞？— Zip...
zip-shotgun
ZIP Shotgun Utility script to test zip file upload functionality and possible extraction of zip files for vulnerabilities aka Zip Slip. Idea for this script comes from this post on Silent Signal Techblog - Compressed File Upload And Command Execution and from OWASP - Test Upload of Malicious File...
RCE
CVE-2022-31814 WebApp bug root@kitploit: import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser =...
ShellSweep
ShellSweep ShellSweeping the evil Why ShellSweep "ShellSweep" is a PowerShell/Python/Lua tool designed to detect potential web shell files in a specified directory. ShellSheep and it's suite of tools calculate the entropy of file contents to estimate the likelihood of a file being a web shell. Hi...
CVE-2023-4220-exploit
CVE-2023-4220-exploit Unrestricted file upload in the large file upload functionality at /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS versions = 1.11.24 allows unauthenticated attackers to perform stored Cross-Site Scripting attacks and achieve remote code execution by...
weevely3
Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...
weevely3
Weevely - 武器化 Web Shell 描述 Weevely 是一款专为后渗透利用设计的 Web Shell，可在运行时通过网络进行扩展。 将 weevely PHP agent 上传到目标 Web 服务器，即可获取其远程 shell 访问权限。它拥有 30 多个模块，可辅助完成管理任务、维持访问权限、提供态势感知、提升权限，并扩散到目标网络中。 请阅读 安装 页面，安装 weevely 及其依赖项。 请阅读 快速开始 页面，生成 agent 并连接到它。 浏览 Wiki，查看示例和使用案例。 使用方法 root@kitploit: weevely generate weevel...
Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...
Chamilo LMS <= 1.11.24 - Remote Code Execution
Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell. id: CVE-2023-422...
CVE-2025-31324-File-Upload
CVE-2025-31324-File-Upload A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files e.g., a JSP web-shell onto the server. Proof-of-concept tool to check for and exploit the unauthenticated file upload vulnerability CVE-2025-31324 in SAP NetWeaver Visual...
CVE-2023-4220_Chamilo_RCE
CVE-2023-4220 Python exploit for Chamilo Unrestricted File Upload Vuln - CVE-2023-4220 The code contained within the repository is meant for educational purposes only. Description: Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in...
JSShell
JSShell 2.0 An interactive multi-user web based javascript shell. It was initially created in order to debug remote esoteric browsers during experiments and research. This tool can be easily attached to XSS Cross Site Scripting payload to achieve browser remote code execution similar to the BeeF...