ScanCVE

This is a PoC exploit for CVE-2021-NNNN, an exploit module/toolkit targeting GitHub. The target product/service is GitHub, and the vulnerability class/vector is not explicitly stated, but it appears to be related to CVE monitoring and alerting. The probable entry point is the ScanCVE.py script,...

metasploit-framework

This is an exploit module for the Metasploit Framework, a penetration testing tool. The module is designed to target a specific vulnerability in a Windows system, exploiting the SMB protocol to gain remote code execution. The module is written in Ruby and is part of the Metasploit Framework's...

vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is a collection of docker-compose files that can be used to create vulnerable environments for testing and training purposes. The environments are designed to be easy to use and require no pre-existing knowledge of...

SQLInjectionWiki

This is a comprehensive wiki on SQL injection, a type of web application security vulnerability. The wiki is maintained by NetSPI and is available in both English and Chinese versions. The wiki covers various aspects of SQL injection, including detection, exploitation, and mitigation. The wiki...

maltrail

This is a malicious traffic detection system, utilizing publicly available blacklists containing malicious and/or generally suspicious trails. The system can detect various types of malicious traffic, including domain name, URL, IP address, and HTTP User-Agent header value. It also uses advanced...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

pocsuite-z Legal Disclaimer Usage of pocsuite for attacking targets without prior mutual consent is illegal. pocsuite is for security testing purposes only 法律免责声明 未经事先双方同意，使用 pocsuite-z 攻击目标是非法的。 pocsuite-z 仅用于安全测试目的 Overview pocsuite-z is an open-sourced remote vulnerability testing and...

vulhub

It is an offensive tool for web application security training. The repository contains a collection of pre-built vulnerable environments based on Docker-Compose, which can be used for web application security training. The tool is designed to be easy to use, requiring only two simple commands to...

PayloadsAllTheThings

It is an offensive tool for general-purpose payloads. The repository contains a collection of payloads for various purposes, but no specific exploit or vulnerability is mentioned. The provided code snippet is a funding model configuration for GitHub Sponsors and Ko-fi, indicating that the...

Gopherus

This is a Python script for a tool called Gopherus, which is used to exploit Server-Side Request Forgery SSRF vulnerabilities in various services. The tool can generate payloads for different services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a...

Vxscan

This is a Python-based comprehensive scanning tool called Vxscan. It is designed to perform various types of scans, including sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning...

exploits

This is an exploit repository containing various tools and scripts for exploiting vulnerabilities in different software products. The primary target of the exploit is the Zoho Meeting application, specifically the "aeagent.exe" process, which has a known vulnerability that allows remote code...

Some-PoC-oR-ExP

This repository is an offensive tool for collecting or writing various vulnerability PoCs proofs of concept and exploits. The primary vulnerability targeted by the code is a remote code execution RCE vulnerability in Apache Tomcat, identified as CNVD-2020-10487. The exploit is implemented in Pyth...

Exploit for CVE-2015-6606

This is a simple exploit for verification of CVE-2015-6606, a code injection vulnerability in the SEEK smartcard service versions 3.1.0 and below. The exploit allows specially crafted Android application packages to inject arbitrary code into the execution context of the smartcard system service,...

vulhub

It is an offensive tool for Vulnerable Environments Based on Docker-Compose. The repository contains a collection of pre-built vulnerable docker environments, allowing users to easily create and test vulnerable environments without requiring prior knowledge of Docker. The tool is designed to be...

vulhub

It is an offensive tool for web application security training. The primary target product/service or framework is not explicitly stated, but it appears to be a collection of vulnerable environments based on Docker-Compose. The vulnerability class/vector is not specified, but it likely involves we...

pwn_example

This is a C programming challenge repository, specifically designed for learning and practicing stack-based buffer overflow attacks. The repository contains several example projects, each demonstrating a different type of attack. The main project, "pwnheapbase/useafterfree", is a simple note-taki...

WhyNot-HEAP-Exploitation

This repository is for a proof-of-concept PoC exploit for a vulnerability in the glibc library, specifically targeting the House of Force attack. The House of Force attack is a type of attack that exploits the way glibc handles memory allocation and deallocation, allowing an attacker to control t...

KITT-Lite

This is an offensive tool for wireless network exploitation. It is a collection of scripts and tools for various wireless-related tasks, including wireless network scanning, device identification, and password cracking. The toolset includes scripts for tasks such as: Wireless network scanning usi...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID present in the provided context is CVE-2016-9086. The target product/service or framework is GitLab. The vulnerability class/vector is not explicitly stated, but it is likely related to the mentioned...

Exploit for Improper Input Validation in Microsoft

PoC exploit for CVE-2020-1350, a Windows DNS DoS vulnerability. The target product/service is Windows DNS server, and the vulnerability class/vector is a denial-of-service DoS attack. The probable entry point is the sigreddos.py script, which listens on port 53 on both TCP and UDP. Notable...

vulhub

It is an offensive tool for vulnerable environments. The repository contains a collection of pre-built vulnerable docker environments, including Flask SSTI, Apache Parsing Vulnerability, and more. The tool is designed to be used for testing and training purposes, allowing users to practice...

Office8570

This is a Microsoft PowerPoint presentation file .ppt that contains a malicious payload. The file is encoded with a password, and the presentation itself contains a malicious VBA Visual Basic for Applications macro that can be used to deliver a payload. The presentation contains a slide layout th...

SecGen

This is a Ruby application called SecGen, which creates vulnerable virtual machines for learning and practicing security penetration testing techniques. The application uses Vagrant, Puppet, and Ruby to generate randomly vulnerable virtual machines based on a scenario specification. The scenario...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, called ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Jav...

pocsuite

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, known as Pocsuite. It is developed by the Knownsec Security Team and comes with a powerful proof-of-concept engine, many niche features for penetration testers and security researchers. The framewo...

IntruderPayloads

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

CVE-2017-11882 文章链接 隐藏17年的Office远程代码执行漏洞（CVE-2017-11882） http://www.cnblogs.com/Hi-blog/p/7878054.html...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not specified, but the environments are designed to be vulnerable to various attacks. The probable entry points are not explicitly stated, but the environments are likely to be...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for vulnerability research and testing. The target product/service or framework is not explicitly stated, but it appears to be a collection of vulnerable environments for various...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not specified, but it includes various types of vulnerabilities such as SQL injection, cross-site scripting XSS, and remote code execution RCE. The target product/service or...

SecGen

This is a Ruby application called SecGen, which generates vulnerable virtual machines for security penetration testing. The application uses Vagrant, Puppet, and Ruby to create randomly vulnerable virtual machines based on a scenario specification. The scenario can specify constraints and...

vulhub

It is an offensive tool for web application security training. The repository contains a collection of pre-built vulnerable environments based on Docker-Compose, allowing users to easily set up and test various web application vulnerabilities. The tool is designed for security training and...

vulhub

It is an offensive tool for vulnerable environments. The target product/service or framework is a collection of pre-built vulnerable docker environments. The vulnerability class/vector is various, including but not limited to SQL injection, cross-site scripting, and remote code execution. The...

Exploit for Deserialization of Untrusted Data in Oracle Access_Manager

CVE-2020-2555 概述 在2020年1月，互联网上爆出了Weblogic反序列化远程命令执行漏洞（CVE-2020-2555），Oracle Fusion中间件Oracle Coherence存在缺陷，攻击者可利用该漏洞在未经授权下通过构造T3协议请求，获取Weblogic服务器权限，执行任意命令，风险较大。 影响 Oracle Coherence 3.7.1.17 Oracle Coherence & Weblogic 12.1.3.0.0 Oracle Coherence & Weblogic 12.2.1.3.0 Oracle Coherence & Weblogic...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The repository contains a collection of docker-compose files for various vulnerable environments, including Flask SSTI, Apache Parsing Vulnerability, and more. The environments are designed to be easy to use, with simple...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 CVE-2018-2628漏洞工具包 根据Github上整理出的漏洞利用工具包含： 1.CVE-2018-2628漏洞检测工具 //漏洞存在检测的POC 2.weblogicpoc.py //漏洞利用的POC 3.ysoserial-0.1-cve-2018-2628-all.jar //借鉴的漏洞利用工具https://github.com/tdy218/ysoserial-cve-2018-2628/releases 具体的漏洞复现过程请移步简书：https://www.jianshu.com/p/6649118ba7b6...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an offensive tool for web application security testing. The primary CVE ID present in the provided context is CVE-2016-9086. The target product/service or framework is GitLab. The vulnerability class/vector is a remote code execution RCE vulnerability. The probable entry point is the GitLab...

penetration

The repository contains a collection of exploit files and scripts for various vulnerabilities in web applications, specifically CMS platforms. The exploits are categorized by the affected CMS, with each category containing multiple exploit files. The exploits are written in various programming...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

This is a PoC exploit for CVE-2020-0796, a Windows SMBv3 LPE Local Privilege Escalation vulnerability. The exploit is written in C++ and uses the Windows API to manipulate system handles and exploit the vulnerability. The code includes a function to get the address of a handle, and another functi...

pwn_category

This is a PoC exploit for a vulnerability in the GNU C Library glibc version 2.3.4. The exploit targets the printfchk function, which is used to perform formatted printing. The vulnerability allows for arbitrary read and write operations in the heap, which can be used to achieve code execution. T...

antSword

This is a comprehensive analysis of the provided code and metadata from the AntSword repository. Classification: Exploit module/toolkit targeting web applications Primary CVE ID: Not specified Target product/service or framework: Web applications Vulnerability class/vector: Not specified Probable...

Information_Collection_Handbook

It is an offensive tool for information collection. The repository contains a collection of tools and scripts for gathering information about a target, including domain information, application information, and more. The tools are likely used for reconnaissance and intelligence gathering purposes...

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

CVE-2018-2628 CVE-2018-2628漏洞工具包 根据Github上整理出的漏洞利用工具包含： 1.CVE-2018-2628漏洞检测工具 //漏洞存在检测的POC 2.weblogicpoc.py //漏洞利用的POC 3.ysoserial-0.1-cve-2018-2628-all.jar //借鉴的漏洞利用工具https://github.com/tdy218/ysoserial-cve-2018-2628/releases 具体的漏洞复现过程请移步简书：https://www.jianshu.com/p/6649118ba7b6...

EQGRP

This is a repository containing the decrypted contents of a file named "eqgrp-auction-file.tar.xz". The repository includes three files: "Linux/bin/7z", "Linux/bin/7z.so", and "Linux/bin/7za". These files are likely related to the 7-Zip file archiver. The "Linux/bin/7z" file is an ELF Executable...

awesome-jenkins-rce-2019

No description...

wolfssl

This is a collection of files related to the wolfSSL library, a cryptographic library for embedded systems. The library is designed to be compatible with Arduino projects and provides a range of cryptographic functions, including SSL/TLS, RSA, and AES. The files include: IDE/ARDUINO/README.md: A...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly mentioned, but the repository contains various vulnerable environments based on Docker-Compose, including ones for CVE-2016-9086, CVE-2017-1000353, and CVE-2018-1000006. The target...

commix

This is an automated tool for testing web-based applications to find command injection vulnerabilities. It is written in Python and can be used by web developers, penetration testers, or security researchers. The tool is designed to test web-based applications with the view to find bugs, errors, ...

jailbreakme-unified

This is a web-based jailbreak solution that unifies existing jailbreak solutions and new ones. It is created by Sem Voigtländer and supports various iOS versions, including 8.4.1, 9.3 up to 9.3.3, 11.3.1, and 12.0 up to 12.0.1 64-bit, as well as 3.1.2 up to 4.0.1 and 8.4.1 and 9.1 up to 9.3.4...

vmware_escape

This is a VMware Escape Exploit targeting VMware WorkStation 12.5.5. The exploit is designed to escape the sandbox environment and execute arbitrary code on the host system. The exploit is likely to be a heap overflow vulnerability, which is a type of buffer overflow attack that occurs when a...