1965 matches found
exploitdb
This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains exploits, shellcodes, and papers for various vulnerabilities in different software and systems. The exploits are categorized by operating system and vulnerability type, and c...
Exploit for Path Traversal in Microsoft
This is a malicious docx generator for exploiting CVE-2021-40444, a remote code execution vulnerability in Microsoft Office Word. The tool is designed to create a malicious docx document that, when opened, will execute arbitrary code on the victim's system. The tool consists of several files: 1...
Exploit for OS Command Injection in Eyesofnetwork
This is an exploit module for EyesOfNetwork 5.1 to 5.3, a network monitoring and management tool. The exploit targets three vulnerabilities: CVE-2020-8654, CVE-2020-8655, and CVE-2020-9465. CVE-2020-8654 is a discovery module that allows arbitrary OS commands to be run. The exploit uses the targe...
Exploit for CVE-2015-2365
This repository contains a collection of proof-of-concept PoC exploits and tools for various vulnerabilities, including CVE-2015-2365, CVE-2015-2366, and CVE-2015-2507. The exploits are written in C and use assembly code to manipulate system calls and memory. CVE-2015-2365 is a vulnerability in t...
Some-PoC-oR-ExP
This repository is an offensive tool for collecting or writing various vulnerability PoCs proofs of concept and exploits. The primary vulnerability targeted by the code is CNVD-2020-10487, a Tomcat-Ajp local file inclusion LFI vulnerability. The tool is designed to exploit this vulnerability to...
Exploit for CVE-2017-0144
This is a PoC exploit for CVE-2017-0144, also known as the EternalBlue vulnerability, which is a remote code execution vulnerability in the Windows SMBv1 protocol. The exploit is implemented as a Metasploit module, and it targets the Double Pulsar backdoor. The target product/service is the Windo...
POC-EXP
It is an offensive tool for vulnerability exploitation. The repository contains a collection of exploits and proof-of-concept PoC code for various vulnerabilities. No specific CVE or GHSA IDs are mentioned, but the repository is likely focused on demonstrating exploitation techniques rather than...
nuclei-templates
This is a community-curated list of templates for the nuclei engine to find security vulnerabilities in applications. The repository contains various templates for the scanner provided by the team and contributed by the community. The templates are the core of the nuclei scanner, which powers the...
PayloadsAllTheThings
It is an offensive tool for Web Application Security. The repository, PayloadsAllTheThings, contains a list of useful payloads and bypass techniques for web application security and penetration testing/CTF. The provided code snippet is a GitHub funding model configuration file .github/FUNDING.yml...
Exploit for OS Command Injection in Webmin
PoC exploit for CVE-2019-15107 DNSChanger on home routers. The target product/service is Shuttle Tech ADSL Modem-Router 915 WM. The vulnerability class/vector is DNSChanger. The probable entry point is the routerhunter.py script. Notable dependencies/tooling include requests, random, time,...
ctf
It is an offensive tool for reverse engineering. The repository contains a binary decompiler for a "Magic Word" challenge, which appears to be a reverse engineering exercise. The code is written in C++ and utilizes the basicstring class from the C++ Standard Library. The decompiled main function ...
Red-Teaming-Toolkit
This is a collection of open source and commercial tools that aid in red team operations. The repository includes tools for reconnaissance, weaponization, delivery, command and control, lateral movement, establishing a foothold, escalating privileges, data exfiltration, and miscellaneous...
emp3r0r
It is an offensive tool for Linux systems. The tool is called emp3r0r, a Linux post-exploitation framework made by a user named jm33-ng. It is designed to provide a better experience for remote administration on Linux systems, particularly for terminal-based interactions. The framework is written...
PrintNightmare
This is a PoC Proof of Concept exploit for the Print Nightmare vulnerability, which affects Windows Print Spooler service. The repository contains a Visual Studio solution file EXP/POC.sln that includes a C++ project POC with a main function. The project uses the RPC Remote Procedure Call client...
Exploit for OS Command Injection in Dlink Dir-859_Firmware
IoT-vulhub 受 Vulhub 项目的启发，希望做一个 IoT 版的固件漏洞复现环境。 安装 在 Ubuntu 20.04 下安装 docker 和 docker-compose： sh 安装 pip $ curl -s https://bootstrap.pypa.io/get-pip.py | python3 安装最新版 docker $ curl -s https://get.docker.com/ | sh 启动 docker 服务 $ systemctl start docker 安装 docker-compose $ python3 -m pip install...
Exploit for CVE-2021-1675
Based on the provided context and code cues, here is a summary of the analysis: Classification: This is an exploit module for the CVE-2021-1675 vulnerability, which is a local privilege escalation LPE vulnerability. Target: The target of this exploit is the Windows operating system, specifically...
Exploit for CVE-2021-1675
C and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527...
Exploit for CVE-2013-6026
PoC exploit for CVE-2013-6026 Joel's Backdoor in D-Link routers. The target product/service is D-Link routers, and the vulnerability class/vector is RCE Remote Code Execution. The probable entry point is the administration panel of the router, which can be accessed without authentication due to t...
Exploit for Off-by-one Error in Sudo_Project Sudo
PoC exploit for CVE-2021-3156, a heap-based buffer overflow in Sudo. The target product/service is Sudo, a Unix command to execute a command with superuser root privileges. The vulnerability class/vector is a heap-based buffer overflow. Notable dependencies/tooling include the Qualys Security...
Exploit for Improper Encoding or Escaping of Output in F5 Nginx
This is an offensive tool for web application security training. It is a collection of vulnerable web applications, each with its own set of vulnerabilities, designed to help users learn and practice web application security testing. The repository contains a variety of web applications, includin...
PayloadsAllTheThings
It is an offensive tool for general use. This repository contains a collection of payloads, likely for testing and exploitation purposes. The payloads are not explicitly described, but the repository's funding model suggests it may be used for offensive security research. The repository includes ...
Exploit for Out-of-bounds Write in Gnu Glibc
PoC exploit for CVE-2018-1000001, a buffer underflow in glibc realpath that allows local privilege escalation. The target product/service is glibc, a dependency of various Linux distributions including Debian and Ubuntu. The vulnerability class/vector is LPE Local Privilege Escalation. The probab...
Gopherus
This is an analysis of the provided repository, specifically focusing on the Gopherus tool. Classification: The Gopherus tool is a proof-of-concept exploit for various vulnerabilities, including SSRF Server-Side Request Forgery and RCE Remote Code Execution. Primary Vulnerability: The primary...
Exploit for Out-of-bounds Write in Php
This is an exploit module for a bug in php-fpm CVE-2019-11043. The exploit targets a vulnerability in certain nginx + php-fpm configurations, allowing a web user to execute code if the configuration is vulnerable. The exploit works by appending a specially crafted URL to the web server, which...
Exploit for Improper Encoding or Escaping of Output in F5 Nginx
This repository is an open-source collection of vulnerable systems and applications for educational purposes, specifically for penetration testing and vulnerability assessment. It is maintained by phith0n and is available on GitHub under the MIT License. The repository contains a variety of...
Exploit for CVE-2021-3129
It is an exploit module for CVE-2021-3129. The target product/service is Laravel, a PHP web framework. The vulnerability class/vector is a remote code execution RCE vulnerability. The probable entry point is the Laravel application itself, likely through a web interface. Not specified...
vulhub
This repository is an offensive tool for building vulnerable environments based on Docker-Compose. It contains a collection of vulnerable applications and services, including CouchDB, FFmpeg, Git, and Jenkins, among others. The repository is maintained by phith0n and is licensed under the MIT...
CMSmap
This is a Python-based open-source CMS scanner called CMSmap, which automates the process of detecting security flaws in popular Content Management Systems CMSs such as WordPress, Joomla, Drupal, and Moodle. The tool is designed to integrate common vulnerabilities for different types of CMSs in a...
Exploit for Code Injection in Pivotal_Software Spring_Data_Commons
Based on the provided code and metadata, here is a description of the repository and its contents: Repository: This repository appears to be a Maven wrapper for the Apache Maven project, specifically version 3.5.3. The repository contains metadata and configuration files for the Maven wrapper,...
vulhubdocker2
This repository is an open-source project for vulnerability research and training, specifically targeting various web applications and services. It is a collection of vulnerable environments and tools for testing and learning about common web application vulnerabilities. The repository contains a...
Exploit for Race Condition in Canonical Ubuntu_Linux
This is a PoC exploit for CVE-2016-5195, a vulnerability in the Linux kernel that allows an unprivileged user to gain root privileges by exploiting a bug in the way the kernel handles page table entries. The exploit is implemented in C++ and Go, and is designed to work on various Linux...
Exploit for Path Traversal in Microsoft
This repository is a proof-of-concept PoC exploit for CVE-2021-40444, a Microsoft Office Word remote code execution vulnerability. The PoC is a malicious docx generator that creates a document that, when opened, will execute arbitrary code on the victim's system. The PoC consists of several files...
vulhub
This repository is an offensive tool for creating pre-built vulnerable environments based on Docker-Compose. It is a collection of vulnerable applications and services that can be used for testing and training purposes. The repository includes a variety of vulnerable applications, such as CouchDB...
Exploit for CVE-2020-1938
This is a proof-of-concept PoC exploit for CVE-2020-1938, a vulnerability in Apache Tomcat's AJP protocol. The exploit is written in Python and utilizes the ajpy library to interact with the AJP protocol. The exploit targets the Local File Inclusion LFI vulnerability in Tomcat, allowing an attack...
Exploit for OS Command Injection in Docker
CVE-2019-5736 is a vulnerability in the runc container runtime that allows for container escape. The exploit works by overwriting the runc binary with a malicious payload, which is achieved by modifying the /bin/sh file in the container to point to the runc binary on the host. The attacker can th...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
PoC exploit for CVE-2021-26084, an OGNL injection vulnerability in Confluence Server and Data Center. The exploit targets Confluence versions prior to 7.12.5, allowing an authenticated user to execute arbitrary code. The exploit is invoked using the ConfluenceOGNLInjection.py script, which takes...
vulhub
This is an open-source collection of vulnerable systems and applications for educational purposes. It is a repository of vulnerable systems and applications, including web servers, databases, and other software, that can be used to test and learn about security vulnerabilities. The repository is...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
补天poc合集 介绍 补天提交漏洞POC合集 目录 fwfileupload.py--泛微OA weaver.common.Ctrl 任意文件上传漏洞 kindeditorupload.py--kindeditor=4.1.5文件上传漏洞 cve-2021-26084confluencerce.py--Atlassian Confluence 远程代码执行漏洞CVE-2021-26084...
KDU
This is a Windows driver code, specifically a device driver for a fictional device called "DUMMYDRV". The code is written in C and is compiled into a Windows driver executable. The code consists of two parts: dummy.sys and dummy2.sys. Both files are Windows driver executables, but they have...
Exploit for Out-of-bounds Write in Linux Linux_Kernel
PoC exploit for CVE-2021-22555, a heap out-of-bounds write affecting Linux since v2.6.19-rc1, discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS via heap memory corruption through user namespace. The exploit is tested on Ubuntu 5.8.0-48-generic and CO...
Exploit for Use After Free in Linux Linux_Kernel
This is a collection of exploit code for various Linux kernel vulnerabilities, specifically CVE-2016-8655, CVE-2017-1000112, CVE-2017-7308, and CVE-2018-18955. The exploits are written in C and use various techniques such as AFPACKET race condition, UDP fragmentation offset, and Linux kernel...
CDK
This is a container penetration toolkit called CDK, which is designed for offering stable exploitation in different slimmed containers without any OS dependency. It comes with useful net-tools and many powerful PoCs/EXPs and helps users to escape container and take over K8s cluster easily. The...
IMChecker
This repository is an offensive tool for API misuse detection. The tool is called IMChecker, and it is designed to automatically detect API misuse in C programs. The tool uses a constraint-directed static analysis technique powered by a domain-specific language DSL for specifying API usage...
exprolog
This is a Python script that exploits a vulnerability in Microsoft Exchange Server. The script is designed to target a specific version of the server and exploit a vulnerability to gain access to the system. Here is a summary of the script's functionality: 1. The script starts by importing the...
Exploit for Server-Side Request Forgery in Microsoft
Exchange SSRF GetShell --- RunCommand CVE-2021–26855.exe -host 10.11.11.24 -mail [email protected] --- 效果图 - 写出webshell到服务器 - 使用菜刀连接webshell...
Gopherus
This is a Python script for a tool called Gopherus, which is used to exploit Server-Side Request Forgery SSRF vulnerabilities in various services. The tool can generate payloads for different services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a...
Exploit for Off-by-one Error in Sudo_Project Sudo
This repository is a collection of exploit code for the CVE-2021-3156 vulnerability in sudo, a Unix command that allows users to execute commands as another user. The vulnerability is a heap-based overflow in the sudo library, which can be exploited to gain elevated privileges. The repository...
Pocsuite
This project is an open-sourced remote vulnerability testing and proof-of-concept development framework called Pocsuite. It is developed by the Knownsec 404 Team and supports Python 2.6+. The framework comes with a powerful proof-of-concept engine and many niche features for penetration testers a...
Hack-Tools
This is an offensive tool for Web Pentesters. It is a browser extension that facilitates web application penetration tests, providing cheat sheets and tools such as XSS payloads, reverse shells, and more. The extension is accessible in either popup mode or a whole tab in the Devtools part of the...