Heartbleed Exploit – Discovery & Exploitation
Tag: exploit
PHPSploit Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner
Overview The obfuscated communication is accomplished using HTTP headers under standard client requests and web server’s relative responses, tunneled through a tiny polymorphic backdoor: <?php @eval($_SERVER[‘HTTP_PHPSPL01T’]); ?> Quick Start git clone https://github.com/nil0x42/phpsploit cd phpsploit/ pip3 […]
XSSer Automated Detection, Exploitation, and Reporting Framework for XSS Vulnerabilities
Cross Site “Scripter” (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications. It provides several options to try to bypass certain filters and various special techniques for code […]
Wing FTP Server 6.3.8 Remote Code Execution
# Exploit Title: Wing FTP Server 6.3.8 – Remote Code Execution (Authenticated) # Date: 2020-06-26 # Exploit Author: v1n1v131r4 # Vendor Homepage: https://www.wftpserver.com/ # Software Link: https://www.wftpserver.com/download.htm # Version: 6.3.8 # Tested on: Windows 10 […]
Archery – A Security Tool
Archery is an opensource vulnerability assessment and management tool which helps developers and pentesters to perform scans and manage vulnerabilities. Archery uses popular opensource tools to perform comprehensive scanning for web application and network. It […]
OpenSSH SCP Client – Write Arbitrary Files
Title: SSHtranger Things Author: Mark E. Haase mhaase@hyperiongray.com Homepage: https://www.hyperiongray.com Date: 2019-01-17 CVE: CVE-2019-6111, CVE-2019-6110 Advisory: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Tested on: Ubuntu 18.04.1 LTS, OpenSSH client 7.6p1 We have nicknamed this “SSHtranger Things” because the bug is […]
KPOT Botnet – File Download/Source Code Disclosure Vulnerability
################################ # Exploit Title: KPOT Botnet – File Download/Source Code Disclosure Vulnerability # Google Dork: n/a # Date: 26/11/2018 # Exploit Author: n4pst3r # Vendor Homepage: unkn0wn # Software Link: https://bhf.io/threads/515432/ # Version: unkn0wn # […]
Apache Spark – Unauthenticated Command Execution (Metasploit)
This module exploits an unauthenticated command execution vulnerability in Apache Spark with standalone cluster mode through REST API. It uses the function CreateSubmissionRequest to submit a malious java class and trigger it. [su_quote] ## # […]
