Educational Heap Exploitation

This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases.

You can run apt source libc6 to download the source code of the Libc your are using on Debian-based operating system. You can also click ▶️ to debug the technique in your browser using gdb.

https://github.com/shellphish/how2heap

​CVE-2022-24086-MASS-RCE

CVE-2022-24086 and CVE-2022-24087 are an rce in adobe commerce and magento

https://github.com/TomArni680/CVE-2022-24086-MASS-RCE

#cve #RCE

​CVE-2022-30190 Follina POC

Host exploit.html on localhost, port 80. Open the docx to pop calc.

To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will literally not run if you omit this from the end of the URL.

The exploit must contain at least 3541 characters before the window.location.href, and they must be within the script tag. There is about 6000 or so included in the exploit.html

https://github.com/onecloudemoji/CVE-2022-30190

#cve #poc

https://www.youtube.com/watch?v=kSwm0u-X_1o

credit:- @f3exe

Secondary Context Path Traversal | Pro Technique | $4000 Starbucks[.]com Bug Bounty
https://youtu.be/4hM-aT049EQ

Aliens_eye - Find all social media accounts with a username!

https://github.com/BLINKING-IDIOT/Aliens_eye

​VPN server configuration software. Protocols: L2TP, PPTP, OpenVPN, WireGuard, Socks5, ShadowSocks (v2ray). | Providers: DigitalOcean, Linode, CryptoServers, Hetzner Cloud, Custom Server

https://github.com/my0419/myvpn-desktop

D1T2 - Philippe Langlois - Hacking HLR HSS and MME Core Network Elements

https://github.com/drego85/JoomlaScan
https://github.com/1N3/Sn1per
https://github.com/aboul3la/Sublist3r
https://github.com/MrMugiwara/CTF-Tools
https://github.com/asciimoo/searx
https://github.com/Dionach/CMSmap
https://github.com/shawarkhanethicalhacker/D-TECT-1
https://github.com/ron190/jsql-injection
https://github.com/khalilbijjou/WAFNinja
https://github.com/Ekultek/whitewidow
https://github.com/anarcoder/google_explorer
https://github.com/anarcoder/WordPressMassExploiter
https://github.com/anarcoder/JoomlaMassExploiter
https://github.com/Neohapsis/bbqsql
https://github.com/rezasp/vbscan/
https://github.com/screetsec/Dracnmap
https://github.com/OWASP/QRLJacking/tree/master/QrlJacking-Framework
https://github.com/k4m4/onioff
https://github.com/sepehrdaddev/blackbox
https://github.com/random-robbie/bruteforce-lists
https://github.com/random-robbie/drupwn
https://github.com/maurosoria/dirsearch
https://github.com/random-robbie/phpunit-brute
https://github.com/random-robbie/mini-php-shells
https://github.com/random-robbie/AutoRecon
https://github.com/KTN1990/WordPress-Easy-WP-SMTP-plugin-0day https://github.com/s0md3v/Photon
https://github.com/KTN1990/ACIDREVERSER
https://github.com/KTN1990/Email-Grabber
https://github.com/KTN1990/joomla-com_xcloner-upload_shell https://github.com/KTN1990/CMS https://github.com/KTN1990/PostgreSQL https://github.com/s0md3v/Breacher
https://github.com/s0md3v/Shiva
https://github.com/s0md3v/proxify
https://github.com/random-robbie/xssfinder
https://github.com/XiphosResearch/exploits
https://github.com/XiphosResearch/wp-user-enum-scripts
https://github.com/rastating/wordpress-exploit-framework
https://github.com/Bayz21/WP-3u3
https://github.com/2inf3rnal/wp-checkout-exploit
https://github.com/dr-iman/wp-content-injection-mass-exploit

imgur[.]com Subdomain Takeover | Bug Bounty
https://youtu.be/IHRVGaug3n8

Anybody Can Ban This Instagram Account https://www.instagram.com/itssneha_890/

JSON web token vulnerability [Cookie clicker] | Bug Bounty
https://youtu.be/h2PxTT9ECVU

​​SMB-Session-Spoofing

The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.

https://github.com/Sq00ky/SMB-Session-Spoofing

https://github.com/CorrieOnly/google-dorks

43 lists of Google Dorks for a variety of purposes:

Amazon/Shopping/Carding dorks
Passwords/usernames/Juicy info dorks
Gaming/Minecraft dorks

and much more

#vulnerabilities #cybersecurity

​​CVE-2022-30525 Zyxel Mass Exploiter

Mass Exploitation tool for Zyxel devices written in Python3. This tool is NOT free to prevent abuse and do not expect to find a fix-it-all proof of concept for exploitation for free. Only for those knowledgeable.

https://github.com/ExploitPwner/CVE-2022-30525-Zyxel-Mass-Exploiter

This is not Breach