XSRFProbe

XSRFProbe 顶级跨站请求伪造审计与利用工具包 -blue.svg 关于 XSRFProbe 是一款高级跨站请求伪造（CSRF/XSRF）审计与利用工具包。它配备了强大的爬虫引擎和众多系统化检查，能够检测大多数CSRF漏洞及其相关的绕过方式，并针对每个发现的漏洞进一步生成可利用的概念验证。更多关于XSRFProbe工作原理的信息，请参见维基上的XSRFProbe 内部机制。 XSRFProbe 维基 • 快速入门 • 常规用法 • 高级用法 • XSRFProbe 内部机制 • 图库 部分特性 运行一整套系统化检查 —— 由响应差异/基准测试引擎支持 —— 之后才将端点声明为易受攻...

CVE-2023-45857-Demo

确认 axios 漏洞 CVE-2023-45857 行为的演示 1. 在 dev container 中启动 2. 在 app 容器中运行npm run dev 3. 访问 http://app.localhost 4. 在浏览器的开发者工具中确认 Cookie 中已设置XSRF-TOKEN 值为CREDENTIALTOKEN HttpOnly 为 false SameSite 为 Strict 5. 按下按钮 6. 在开发者工具中确认对whoami.localhost/api的请求的请求头中存在x-xsrf-token且值为CREDENTIALTOKEN 由于 whoami...

exploit_laravel_cve-2018-15133

针对 CVE-2018-15133 的 Laravel 漏洞利用 该代码利用了 CVE-2018-15133，其基于 kosmiz 的 PoC 和针对此漏洞的 Metasploit 漏洞利用模块。我做这个主要是为了 Hack The Box 上的一台机器，因为当时不想用 Metasploit，同时也当作练习 Python 的一个借口。 以下摘自 CVE 的描述： 在 Laravel Framework 5.5.40 及更早版本、5.6.x 至 5.6.29 版本中，对可能不可信的 X-XSRF-TOKEN 值执行 unserialize 调用时，可能会导致远程代码执行。这涉及...

CVE-2023-45857-Demo

验证 axios 漏洞 CVE-2023-45857 行为的演示 1. 在 dev container 中启动 2. 在 app 容器中执行 npm run dev 3. 访问 http://app.localhost 4. 使用浏览器开发者工具确认 Cookie 中已设置 XSRF-TOKEN 值为 CREDENTIALTOKEN HttpOnly 为 false SameSite 为 Strict 5. 点击按钮 6. 在开发者工具中，确认对 whoami.localhost/api 的请求中包含 x-xsrf-token 头部且值为 CREDENTIALTOKEN whoami...

vertx-web-xsrf

Resumen La implementación CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl en Vert.x Web no crea tokens CSRF únicos por sesión de usuario. Un sitio web malicioso aún puede realizar CSRF obteniendo un token CSRF válido y agregándolo a un formulario HTML, y luego enviando el formulario...

Lab-for-cve-2018-15133

摘要： 利用CVE-2018-15133反序列化漏洞 此利用针对Laravel框架5.5.40及5.6.x至5.6.29版本中的反序列化漏洞。 描述 远程代码执行可能源于对潜在不可信的X-XSRF-TOKEN值进行unserialize调用。这涉及Illuminate/Encryption/Encrypter.php中的decrypt方法以及phpggc中gadgetchains/Laravel/RCE/3/chain.php的PendingBroadcast。攻击者必须知道应用密钥，正常情况下这不会发生，但如果攻击者之前拥有特权访问权限或成功完成了之前的攻击，则可能发生。 前提条件...

Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Axios and Netty. Vulnerabilities include Allowing attackers to reach sensitive loopback or internal services despite the configured protections, Prototype pollution in a third-party dependency may be leveraged...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

Larascript

| | | | | | / || '| / |/ | /|| ' || || ' \ | | | | | | || | | | | | | | | || | || | || , ||| ,|| / ||| ||| ./ | || 作者：@pwnedshell & @rsgbengi 📌 Larascript 是什么？ Larascript 是一个利用 CVE-2018-15133 漏洞的脚本，如果存在漏洞的 Laravel 应用暴露在外，它可以执行远程命令。你可以发送命令并获取响应，例如获取 cat /etc/passwd。但你也可以请求获取一个 shell，它会为你建立一个反向...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

CVE-2026-54694: Improper Input Validation

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026)

Summary Axios is vulnerable to Prototype Pollution / Transport Hijacking ,HTTP Request/Response Splitting via Gadget ,NOPROXY Protection Bypass ,Denial of Service DoS via Uncontrolled Recursion ,SSRF via Incomplete Proxy Bypass ,JSON API Response Manipulation via Prototype Pollution,XSRF Token...

Exploit for CVE-2026-67919

halo plugin rce from a url halo's console lets admins install...

DoS (Denial of Service) axios Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 a...

Important: python3.13-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

AZL-92382 CVE-2026-49854 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...