2055 matches found
metasploit-framework
This is a repository for the Metasploit Framework, a penetration testing tool. The repository contains various files and directories related to the project, including configuration files, documentation, and test scripts. The Metasploit Framework is a powerful tool for testing the security of...
shadowbroker
The repository cjd9023/shadowbroker contains a collection of exploits and tools leaked by the Shadow Brokers, a group known for releasing sensitive information. The exploits are categorized into two main sections: "Exploits" and "Utilities." The "Exploits" section includes 25 exploits targeting...
penetration
相信很多小伙伴都知道XSS测试，至于如何更加有效地插入载荷是一件重复性的高强度劳动工作, 在此本文介绍了一款自动进行插入XSS，并且可以自定义攻击载荷。 这些载荷从几十条到几百条甚至几千条。该脚本也同时包含了一些绕过各种WAF的语句。 0×01 BruteXSS BruteXSS是一个非常强大和快速的跨站点脚本暴力注入。它用于暴力注入一个参数。 该BruteXSS从指定的词库加载多种有效载荷进行注入并且使用指定的载荷和扫描检查这些参数很容易受到XSS漏洞。 得益于非常强大的扫描功能。在执行任务时,BruteXSS是非常准确而且极少误报。...
nuclei-templates
No description...
Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware
This repository is an offensive tool for web application exploitation. The primary vulnerability targeted is CVE-2022-30525, a server-side request forgery SSRF vulnerability in a web application. The tool is designed to exploit this vulnerability by sending a specially crafted request to the targ...
vulhub
This is an open-source vulnerability training platform. It is a collection of vulnerable environments for training and testing purposes, allowing users to practice their penetration testing and vulnerability assessment skills in a safe and controlled environment. The platform is maintained by the...
vulhub
This repository is an open-source project for vulnerability research and training, maintained by phith0n. It contains a collection of vulnerable environments and tools for testing and learning about various security vulnerabilities. The repository is hosted on GitHub and has a community-driven...
csv-plus_vulnerability
No description...
Exploit for Classic Buffer Overflow in Openssl
Vulnerabilityrecurrence-漏洞复现 介绍 复现部分与汽车网络安全相关的漏洞. 软件架构 - OpenSSL CVE-2021-3711 SM2 Decryption Buffer Overflow 使用说明 1. 请参考各分部分 readme 文件. 2. 所有内容搜集于网路,请勿用于非法途径,仅供学习参考. 参与贡献 1. Fork 本仓库 2. 新建 Featxxx 分支 3. 提交代码 4. 新建 Pull Request...
vulhub
This is an open-source collection of vulnerable systems and applications for educational purposes. The repository is maintained by phith0n and is available on GitHub. It contains a variety of vulnerable systems and applications, including web applications, databases, and operating systems. The...
PayloadsAllTheThings
It is an offensive tool for general-purpose payloads. The repository contains a list of supported funding platforms, including GitHub Sponsors, Ko-fi, and Buy Me a Coffee. The primary funding platform mentioned is GitHub Sponsors, with the username swisskyrepo. No specific exploit or vulnerabilit...
Exploit for Improper Encoding or Escaping of Output in F5 Nginx
This repository is an open-source collection of vulnerable systems and applications for educational purposes, known as Vulhub. It is a defensive blue-team research and threat mitigation tool, used to improve detection, response, and patch prioritization. The repository contains a variety of...
log4j2-bug-recurrent
log4j2漏洞复现demo 演示版本 ------ jdk : jdk8u181 log4j2 : 2.12.0 log4j2漏洞范围:2.0 jdk.version jdk.version 8u191 还有其他版本不一一列出 server-simple:模拟一个生产服务 attack-simple:模拟的攻击代码 rmi-service :模拟黑客的rmi服务...
Exploit for Code Injection in Gitlab
The provided code is a Python script that exploits a vulnerability in GitLab CE/EE versions 11.9 and earlier. The vulnerability is related to the way GitLab handles image files, allowing an attacker to execute arbitrary code on the server. Here's a breakdown of the code: 1. The script starts by...
Exploit for Argument Injection in Phpmailer_Project Phpmailer
This is a Python script that exploits a vulnerability in PHPMailer version 5.2.18. The script is designed to be run on a vulnerable environment, and it will spawn a vulnerable web application on the host on port 8080. The exploit will drop a shell where commands can be sent to the backdoor. The...
CVE-2021-3493
No description...
Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq
This is a Python script for exploiting a vulnerability in Apache ActiveMQ. The script is designed to upload a shell to the server using the PUT method. The vulnerability being exploited is CVE-2016-3088. The script requires the user to provide the URL of the ActiveMQ server, the username, and the...
vulhub
This is an open-source collection of vulnerable web applications and environments for testing and learning purposes. It is a community-driven project that aims to provide a safe and controlled environment for users to practice and improve their skills in web application security. The repository...
pentest-wiki
This repository is an information gathering library for penetration testers and researchers, providing a collection of tools and documentation for gathering information about a target organization. The library includes tools for DNS enumeration, whois searches, and Linux system architecture and...
SpringBootVulExploit
This repository is an offensive tool for Spring Boot exploitation. It contains various modules and scripts that can be used to exploit vulnerabilities in Spring Boot applications. The primary vulnerability being targeted is a deserialization vulnerability in the Spring Boot framework, which can b...
ctf
It is an offensive tool for reverse engineering. The repository contains a binary decompiler for a "Magic Word" challenge, which appears to be a reverse engineering exercise. The code is written in C++ and utilizes the basicstring class from the C++ Standard Library. The decompiled main function ...
emp3r0r
It is an offensive tool for Linux systems. The tool is called emp3r0r, a Linux post-exploitation framework made by a user named jm33-ng. It is designed to provide a better experience for remote administration on Linux systems, particularly for terminal-based interactions. The framework is written...
PayloadsAllTheThings
It is an offensive tool for general use. This repository contains a collection of payloads, likely for testing and exploitation purposes. The payloads are not explicitly described, but the repository's funding model suggests it may be used for offensive security research. The repository includes ...
KDU
This is a Windows driver code, specifically a device driver for a fictional device called "DUMMYDRV". The code is written in C and is compiled into a Windows driver executable. The code consists of two parts: dummy.sys and dummy2.sys. Both files are Windows driver executables, but they have...
IMChecker
This repository is an offensive tool for API misuse detection. The tool is called IMChecker, and it is designed to automatically detect API misuse in C programs. The tool uses a constraint-directed static analysis technique powered by a domain-specific language DSL for specifying API usage...
vulhub
This is an open-source collection of vulnerable web applications and environments for testing and learning about web application security. It is a project maintained by phith0n and hosted on GitHub. The repository contains a variety of applications and environments, including CouchDB, FFmpeg, Git...
Exploit for CVE-2020-14882
CVE-2020-14882ALL CVE-2020-14882ALL综合利用工具，支持命令回显检测、批量命令回显、外置xml无回显命令执行等功能。 需要模块：requests、http.client （工具仅用于授权的安全测试，请勿用于非法使用，违规行为与作者无关。） 选项 功能一：命令回显 python3 CVE-2020-14882ALL.py -u http://1.1.1.1:7001 -c "net user" python3 CVE-2020-14882ALL.py -u http://1.1.1.1:7001 -c "whoami" 功能二：批量命令回显 python3...
impacket1472
This is a Python library called Impacket, which provides a collection of classes for working with network protocols. The library is focused on providing low-level programmatic access to the packets and for some protocols e.g. SMB1-3 and MSRPC the protocol implementation itself. The library includ...
redpill
This is a PowerShell module repository called "redpill" that provides various post-exploitation tools for Windows systems. The repository contains several scripts that can be used to perform different tasks such as: Bypassing AppLocker restrictions Hijacking browser cookies Downloading and...
vulhub
This is an open-source collection of vulnerable web applications and environments for security training and testing. It is a repository of vulnerable systems and applications that can be used to practice and improve one's skills in penetration testing and vulnerability assessment. The repository...
vulhub
This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and services. It contains a collection of exploits and tools for identifying and exploiting vulnerabilities in software and systems. The primary vulnerability targeted...
purple-team-attack-automation
This is an offensive tool for Metasploit Framework. The tool is designed to automate the process of exploiting vulnerabilities in various systems. It is likely used for penetration testing and vulnerability assessment purposes. The tool is written in Ruby and utilizes the Metasploit Framework,...
vulhub
This repository is an open-source collection of vulnerable web applications and environments for testing and learning purposes. It is maintained by phith0n and hosted on GitHub. The repository contains a variety of applications, including web servers, databases, and other services, that are...
edusrc_POC
This repository contains a collection of Python scripts, each designed to exploit vulnerabilities in various web applications. The scripts are written in Chinese and appear to be intended for use on Chinese-language systems. The scripts are categorized into several groups, each targeting a specif...
PowerShell-Suite
This repository is an offensive tool for Windows UAC User Account Control bypass. It provides a framework to perform UAC bypasses based on auto-elevating IFileOperation COM object method calls. The tool is written in C and uses the .NET framework. The tool supports several methods for UAC bypass,...
PayloadsAllTheThings
It is an offensive tool for Web Application Security and Pentest/CTF. The repository contains a list of useful payloads and bypass techniques. The primary CVE ID is not explicitly mentioned, but it appears to be a collection of various exploits and tools. The target product/service or framework i...
vulhub
This repository is an open-source collection of pre-built vulnerable Docker environments, known as Vulhub. It is an offensive tool for testing and demonstrating vulnerabilities in various software and systems. The primary vulnerability class/vector targeted by Vulhub is not explicitly stated, but...
vulhub
This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for web application security testing and vulnerability research. The primary vulnerability class targeted by this collection is web application vulnerabilitie...
Exploit for Privilege Context Switching Error in Canonical Ubuntu_Linux
PoC exploit for CVE-2021-3493, a local privilege escalation vulnerability in Ubuntu OverlayFS. The target is the Linux kernel, specifically the overlayfs file system, which did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker coul...
vulhub2
This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for various areas, including web application security, web server security, and more. The primary purpose of Vulhub is to provide a simple and easy-to-use...
Exploit for SQL Injection in Zabbix
This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for web application security training and testing. The primary vulnerability class targeted by Vulhub is web application vulnerabilities, including Remote Cod...
metasploit-framework
This is an exploit module for the Metasploit Framework, a penetration testing tool. The module is designed to exploit a vulnerability in a specific target, which is not explicitly stated in the provided code. However, based on the code and the context, it appears that the target is a Windows...
Exploit for SQL Injection in Zabbix
This is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for web application security testing. The primary CVEs mentioned in the repository are CVE-2016-10134, CVE-2017-2824, and CVE-2020-11800. The target product/service or framework is not explicitl...
Exploit for CVE-2020-14882
CVE-2020-14882ALL CVE-2020-14882ALL综合利用工具，支持命令回显检测、批量命令回显、外置xml无回显命令执行等功能。 需要模块：requests、http.client （工具仅用于授权的安全测试，请勿用于非法使用，违规行为与作者无关。） 命令回显模块已知成功版本：12.2.1.3.0、12.2.1.4.0、14.1.1.0.0 选项 功能一：命令回显 python3 CVE-2020-14882ALL.py -u http://1.1.1.1:7001 -c "net user" python3 CVE-2020-14882ALL.py -u...
vulscan
This is a Python-based web application for vulnerability scanning and management. The application is built using Django and has several features, including: 1. Vulnerability Scanning: The application can scan for vulnerabilities in web applications using a variety of plugins POCs. 2. Plugin...
ysoserial
This is a Java-based tool called ysoserial, which generates payloads that exploit unsafe Java object deserialization. The tool is designed to create payloads that can be used to attack vulnerable Java applications. The tool uses a variety of payloads, including CommonsCollectionsK1,...
Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software
PoC exploit for CVE-2020-3452, an unauthorized remote file reading vulnerability in Cisco Adaptive Security Appliance and FTD Software. The exploit uses Shodan to scan for vulnerable targets, then attempts to exploit the vulnerability by sending crafted HTTP requests to the identified targets. Th...
CTF-All-In-One
This is a book about CTF Capture The Flag competitions, specifically the Pwn binary exploitation module. The book is written by Yang Cheng, a member of L-Team, and is aimed at beginners. It covers the basics of binary security, including x86/x64 platforms, Linux systems, and the basics of exploit...
PayloadsAllTheThings
It is an offensive tool for funding. This repository contains a collection of funding models, including GitHub Sponsors, Ko-fi, and Buy Me a Coffee. The primary vulnerability class is not explicitly stated, but the tool appears to be related to funding models rather than a specific vulnerability...