1940 matches found
agent-security-guide
本项目提供针对OpenClaw平台的AI Agent安全治理方案，解决AI Agent权限失控、风险难量化、治理难落地、合规难满足等核心问题。目标可10分钟完成安全评估，一键加固提升安全评分，提供完整治理工具与指南，帮助您高效满足等保2.0、OWASP等合规要求。...
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
PoC exploit for CVE-2017-12149, an arbitrary file upload vulnerability in JBoss Application Server. The exploit module targets the JBoss Application Server, specifically the CVE-2017-12149 vulnerability, which allows for arbitrary file uploads. The module is designed to exploit this vulnerability...
poc-lab
Recent CVE PoC & reproduction scripts. Focused on high-severity vulnerabilities across Linux kernel, Windows, macOS and more...
auto-test-platform
自动化测试平台-用于POC测试团队...
Pocsuite
Pocsuite 是知道创宇安全研究团队打造的一款开源的远程漏洞测试框架，Pocsuite is an open-sourced remote vulnerability testing framework developed by the Knownsec Security Team...
metasploit-framework
Metasploit Framework...
nuclei-templates1
No description...
nuclei-templates
No description...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4j2-CVE-2021-44228 介绍 Log4J的漏洞复现 软件架构 软件架构说明 安装教程 1. git clone https://gitee.com/demonbhao/log4j2-cve-2021-44228.git 2. 安装JDK1.8.0以下版本 3. 安装maven，打包需要 使用说明 1. 编写你的poc代码块 2. 编译Exploit.java javac Exploit.java 形成Exploit.class 3. 开启LDAP协议 4.开启http服务器，用python简单开启，注意要和被访问的端口一致...
Exploit for Path Traversal in Apache Http_Server
No description...
Exploit for Code Injection in Redhat Richfaces
CVE-2018-14667-poc Richfaces漏洞环境及PoC 靶场：vulenvironment下的war包直接丢到tomcat即可 PoC build:build artifactId run:java -jar CVE-2018-14667-poc.jar "cmd" about debug 直接将vulenvironment下的war包下的war解压，然后从idea导入，并将tomcat下的lib添加到library path request demo： GET...
Exploit for CVE-2018-8453
cve-2018-8453-exp cve-2018-8453 exp 本程序为cve-2018-8453的利用程序。 开发\测试平台：x86: windows 10 rs2 15063 x64: windos 10 rs2 16299 附： 使用Palette来读写内核 严重声明： 本工具仅用于技术研究学习。非法使用造成一切后果，均与本人无关。...
wifi-arsenal
This repository is an offensive tool for WiFi attacks. It is a collection of tools and scripts for various WiFi attacks, including denial of service, encryption attacks, WEP/WPA/WPA2 attacks, WPS attacks, and others. The repository includes tools for injection, rogue AP/fake AP/MITM, sniffing,...
sinatra
Classy web-development dressed in a DSL official / canonical repo...
Exploit for Use After Free in Linux Linux_Kernel
This is a collection of exploit code for various Linux kernel vulnerabilities, specifically CVE-2016-8655, CVE-2017-1000112, CVE-2017-7308, and CVE-2018-18955. The exploits are written in C and use various techniques such as AFPACKET race condition, UDP fragmentation offset, and Linux kernel...
claude-code-guide
No description...
LyInjector
一款功能强大的应用层反汇编代码注入器，实现了DLL注入，ShellCode注入等功能，是一款不错的后渗透利器。 A powerful application layer disassembly code injector that implements DLL injection, ShellCode injection, and other functions, is a good post penetration tool...
Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
This is a PoC exploit for CVE-2021-44228, a remote code execution vulnerability in Apache Log4j2. The repository contains a Java application that demonstrates the exploitation of this vulnerability. The application is built using Maven and includes various marshalling libraries that allow for...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft
This is a proof-of-concept PoC exploit for CVE-2020-0796, also known as SMBGhost, a pre-authentication remote code execution RCE vulnerability in the SMBv3 protocol. The exploit is written in Python and uses the SMB protocol to inject shellcode into the target system. The exploit targets Windows...
Exploit for OS Command Injection in Webmin
This repository contains a proof-of-concept PoC exploit for CVE-2019-15107, a vulnerability in the NetScape 2.0 browser. The exploit is a GIF file that, when opened, will execute arbitrary code on the victim's system. The exploit targets the vulnerability in the browser's GIF89a parser, which...
commix
Automated All-in-One OS Command Injection Exploitation Tool...
nuclei-templates
nuclei templates...
claude-code-guide
No description...
Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
This is a Java project for a web application that uses the Log4j library. The project is a practice environment for testing and learning about the Log4j vulnerability CVE-2021-44228. The project includes a Maven project settings file, a Java class file, and a Log4j configuration file. The Log4j...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
This repository is a proof-of-concept PoC exploit for CVE-2021-44228, a vulnerability in the Log4j logging library. The exploit targets the Log4j 2 library, which is a popular logging framework for Java applications. The exploit uses the JNDI Java Naming and Directory Interface protocol to inject...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft
CVE-2020-0796 提权 Windows SMBv3 LPE Exploit Authors Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso References https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 https://www.synacktiv.com/posts/exploit/im-smbghost-daba-dee-daba-da.html...
kernel_exploit_series
This is a collection of files related to a vulnerable driver, specifically targeting the Linux kernel. The files are part of a repository called "povcfe/kernelexploitseries". The files include: 1. 1-heapsprayUAF/easyuaf.c: This file appears to be a simple example of a heap spray vulnerability,...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft
This is a PoC exploit for CVE-2020-0796, a SMBv3 RCE vulnerability. The exploit is a simple scanner that checks if a server is vulnerable by sending a specially crafted SMB request. The scanner is designed to test whether a server is vulnerable, not for research or development. It checks for SMB...
cyberange
网络安全渗透测试学习与训练靶场，包含Web漏洞靶场、渗透工具脚本、攻防手册等。内含：邻里圈靶场16+隐藏漏洞，含SQL注入/XSS/命令注入/文件上传/路径遍历等、零依赖渗透脚本、全工具链渗透脚本、PHP/CGI木马、反向Shell、密码破解工具、蜜罐防御系统、Metasploit精简版、Hacker OS一键构建脚本，以及DVWA攻防手册、Kali工具手册、recon-ng手册等学习文档。适合网络安全入门学习和CTF备赛参考。...
ctf-skills
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more...
TrafficEye
该工具适用于 HW 蓝队对网络流量的深入分析，帮助安全研究人员、渗透测试人员及网络管理员等专业人士识别潜在的安全威胁，尤其是针对 Web 应用的攻击（如 SQL 注入、XSS、WebShell 等）。其模块化设计使用户能够根据实际需求自由选择并定制各类功能模块。 This tool is designed to help penetration testers and network administrators identify potential security threats, especially those targeting web applications such as...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
安全相关的测试 介绍 安全相关的测试，仅供学习！ 1.log4j2 CVE-2021-44228漏洞问题复现...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
It is an offensive tool for Log4j RCE CVE-2021-44228 vulnerability scanning. The primary CVE ID is CVE-2021-44228. The target product/service is Apache Log4j. The vulnerability class/vector is RCE Remote Code Execution. The probable entry points are scripts/modules such as log4j-scan.py. Notable...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
PoC exploit for CVE-2021-44228, a vulnerability in the Log4j Java library. The target product/service is Log4j, a Java logging library, and the vulnerability class/vector is a Remote Code Execution RCE vulnerability. The probable entry point is the "sendDetectionRequest" function in the...
Hack-Tools
This is an offensive tool for Web Pentesters. It is a browser extension that facilitates web application penetration tests, providing cheat sheets and tools such as XSS payloads, reverse shells, and more. The extension is accessible in either popup mode or a whole tab in the Devtools part of the...
Exploit for Improper Input Validation in Jenkins
hackUtils It is a hack tool kit for pentest and web security research, which is based on BeautifulSoup bs4 module http://www.crummy.com/software/BeautifulSoup/bs4/. Usage: hackUtils.py options Options: -h, --help Show basic help message and exit -b keyword, --baidu=keyword Fetch URLs from Baidu...
Exploit for CVE-2020-2551
CVE-2020-2551 Weblogic IIOP 反序列化 测试环境 Weblogic10.3.6+jdk1.6 打包好的jar包 提取码：a6ob 漏洞利用 下载jar包，然后使用marshalsec起一个恶意的RMI服务，本地编译一个exp.java java package payload; import java.io.IOException; public class exp public exp String cmd = "curl http://172.16.1.1/success"; try...
漏洞利用链自动构建程序
可自动提取CVE标准.json格式漏洞作为数据源自动生成漏洞利用链...
claude-code-guide
No description...
Exploit for Code Injection in Apache Rocketmq
Apache RocketMQ NameServer 任意文件写入漏洞（CVE-2023-37582）漏洞复现POC，java版本 该poc为复现https://github.com/vulhub/vulhub/tree/master/rocketmq/CVE-2023-37582https://gitee.com/link?target=https%3A%2F%2Fgithub.com%...
V-APF
V-APF 是一款机器学习驱动的自动化 Web 安全检测框架。通过对 Web 页面在“基线请求 vs. 探测请求”间的语义指纹差异进行量化，结合随机森林 Random Forest模型，自动识别 SQLi / XSS 等漏洞并生成报告。...
vulhub
This is an offensive tool repository for vulnerability research and testing, specifically targeting various web applications and services. The repository contains a collection of exploits, proof-of-concept PoC code, and tools for identifying and exploiting vulnerabilities in software and systems...