棱角社区
@EdgeSecurity
83 subscribers
12 photos
444 links
网络安全事件推送.
Download Telegram
About
Blog
Apps
Platform
Join
棱角社区
83 subscribers
棱角社区
#漏洞 F5从认证绕过到远程代码执行漏洞分析
https://blog.riskivy.com/f5%e4%bb%8e%e8%ae%a4%e8%af%81%e7%bb%95%e8%bf%87%e5%88%b0%e8%bf%9c%e7%a8%8b%e4%bb%a3%e7%a0%81%e6%89%a7%e8%a1%8c%e6%bc%8f%e6%b4%9e%e5%88%86%e6%9e%90/
Riskivy
F5从认证绕过到远程代码执行漏洞分析 - 斗象能力中心
斗象智能安全，以IT资产为核心的全息安全监控与分析，为企业建立全新模式的安全服务体系
56 views
棱角社区
#漏洞 Browser logic vulnerabilities
https://github.com/Metnew/uxss-db
GitHub
GitHub - Metnew/uxss-db: 🔪Browser logic vulnerabilities :skull_and_crossbones:
🔪Browser logic vulnerabilities :skull_and_crossbones: - Metnew/uxss-db
57 views
棱角社区
#漏洞 Eclipse Jetty 拒绝服务 (CVE-2020-27223)
https://github.com/motikan2010/CVE-2020-27223
GitHub
GitHub - motikan2010/CVE-2020-27223: CVE-2020-27223 Vulnerability App & PoC
CVE-2020-27223 Vulnerability App & PoC. Contribute to motikan2010/CVE-2020-27223 development by creating an account on GitHub.
56 views
棱角社区
#bountytip 负载均衡下的 WebShell 连接
https://mp.weixin.qq.com/s/4Bmz_fuu0yrLMK1oBKKtRA
Weixin Official Accounts Platform
负载均衡下的 WebShell 连接
负载均衡的场景大家遇到的不是一两回了，很多人遇到能出外网的可以轻松搞定，遇到那种节点机器不出网的就人傻了，今天咱们拿捏一下。
55 views
棱角社区
#漏洞 CVE-2021-1732 msf:
https://github.com/rapid7/metasploit-framework/pull/14907
GitHub
Add exploit for CVE-2021-1732 by zeroSteiner · Pull Request #14907 · rapid7/metasploit-framework
This adds an exploit for CVE-2021-1732 which is a vulnerability in win32k. By calling NtUserConsoleControl in a callback function and passing the window that is currently being created, a field can...
59 views
棱角社区
#bountytip 免费的一些逆向工程相关的资料课程
https://github.com/mytechnotalent/Reverse-Engineering-Tutorial
GitHub
GitHub - mytechnotalent/Reverse-Engineering: A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit…
A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures. - mytechnotalent/Reverse-Engineering
55 views
棱角社区
#漏洞 RCE Exploit in BIG-IP.
CVE-2021-22986, CVE-2021-22987

python f5_rce.py -u https://ip_target
python f5_rce.py -f ip_list.txt
python f5_rce.py -c "$commend"
https://github.com/h4x0r-dz/RCE-Exploit-in-BIG-IP
GitHub
GitHub - h4x0r-dz/RCE-Exploit-in-BIG-IP
Contribute to h4x0r-dz/RCE-Exploit-in-BIG-IP development by creating an account on GitHub.
55 views
棱角社区
#漏洞 帆软报表 v8.0 任意文件读取漏洞 CNVD-2018-04757
https://mp.weixin.qq.com/s/ae8A8PGJCtr6uS11dRpzcw
Weixin Official Accounts Platform
帆软报表 v8.0 任意文件读取漏洞 CNVD-2018-04757
54 views
棱角社区
#工具 Lazyrecon是一个子域发现工具，可发现并解析有效的子域并执行SSRF / LFI / SQLi模糊测试。它具有简单的模块化体系结构，并针对与Wayback机器一起使用时的速度进行了优化。

https://github.com/storenth/lazyrecon/
GitHub
GitHub - storenth/lazyrecon: Wicked sick v2.0 script is intended to automate your reconnaissance process in an organized fashion.
Wicked sick v2.0 script is intended to automate your reconnaissance process in an organized fashion. - storenth/lazyrecon
56 views
棱角社区
一些在线工具：https://forum.ywhack.com/bountytips.php?tools
Ywhack
[~]#棱角 ::Edge.Forum*
52 views
棱角社区
#bountytip 华为系列设备默认密码：https://forum.ywhack.com/bountytips.php?huawei
其它安全设备默认密码：https://forum.ywhack.com/bountytips.php?password

常用的一些字典：https://forum.ywhack.com/wordlists.php
Ywhack
[~]#棱角 ::Edge.Forum*
54 views
棱角社区
#漏洞 MessageSolution 企业邮件归档管理系统信息泄露漏洞 CNVD-2021-10543
https://mp.weixin.qq.com/s/jehAIIYWrpkLtGvGN-LtFA
Weixin Official Accounts Platform
（CNVD-2021-10543）｜MessageSolution 企业邮件归档管理系统 EEA 存在信息泄露漏洞
0x01 漏洞说明MessageSolution企业邮件归档管理系统 EEA是北京易讯思达科技开发有限公司开
52 views
棱角社区
#工具 基于浏览器的快速网络发现模块

https://github.com/serain/netmap.js
GitHub
GitHub - serain/netmap.js: Fast browser-based network discovery module
Fast browser-based network discovery module. Contribute to serain/netmap.js development by creating an account on GitHub.
54 views
棱角社区
#工具 FuzzingTool：Web渗透测试工具
https://github.com/NESCAU-UFLA/FuzzingTool
GitHub
GitHub - NESCAU-UFLA/FuzzingTool: Software for fuzzing, used on web application pentestings.
Software for fuzzing, used on web application pentestings. - NESCAU-UFLA/FuzzingTool
55 views
棱角社区
#bountytip 403 Forbidden Page Bypass — Rare Exploitation of frequently seen Vulnerability
https://uduthalavankumar.medium.com/403-forbidden-page-bypass-rare-exploitation-of-frequently-seen-vulnerability-ee16c434add7
56 views
棱角社区
#工具 swagger-exp Swagger REST API 信息泄露利用工具
https://github.com/lijiejie/swagger-exp
GitHub
GitHub - lijiejie/swagger-exp: A Swagger API Exploit
A Swagger API Exploit. Contribute to lijiejie/swagger-exp development by creating an account on GitHub.
48 views
棱角社区
#漏洞 Apache OFBiz RMI反序列化任意代码执行（CVE-2021-26295） PoC：
https://www.o2oxy.cn/3271.html
www.o2oxy.cn
CVE-2021-26295 Apache OFBiz rmi反序列化 漏洞复现 - print("")
一、环境搭建
51 views
棱角社区
#漏洞 Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）
https://github.com/projectdiscovery/nuclei-templates/pull/1128/files
GitHub
Added CVE-2021-21087 by Daviey · Pull Request #1128 · projectdiscovery/nuclei-templates
Vulnerability in Adobe ColdFusion which is improper input
validation which leads to arbitrary code execution.
Signed-off-by: Dave Walker (Daviey) email@daviey.com
52 views
棱角社区
#漏洞 [CVE-2021-21123] Google Chrome Bug Bounty $5.000 File System Access API - vulnerabilities
https://github.com/Puliczek/CVE-2021-21123-PoC-Google-Chrome
GitHub
GitHub - Puliczek/CVE-2021-21123-PoC-Google-Chrome: 🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by…
🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more... - Puliczek/CVE-2021-21123-PoC-Google-Ch...
51 views
棱角社区
#漏洞 MobileIron MDM Contains Static Key Allowing Account Enumeration

https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration
Optiv
MobileIron MDM Contains Static Key Allowing Account Enumeration
MobileIron MDM exposes account enumeration and SFA to unauthenticated attacks. This analysis details how to mitigate this vulnerability.
53 views
棱角社区
#漏洞 ntopng 流量分析工具多个漏洞分析
http://noahblog.360.cn/ntopng-multiple-vulnerabilities/
root@cyberworld:~# Noah Lab
ntopng 流量分析工具多个漏洞分析
0x00. TL;DRntopng 是一套开源的网络流量监控工具，提供基于 Web 界面的实时网络流量监控。支持跨平台，包括 Windows、Linux 以及 MacOS。ntopng 使用 C++ 语言开发，其绝大部分 Web 逻辑使用 lua 开发。 在针对 ntopng 的源码进行审计的过程中，笔者发现了 ntopng 存在多个漏洞，包括一个权限绕过漏洞、一个 SSRF 漏洞和多个其他安全问题，接着组合利用这些问题成功实现了部分版本的命令执行利用和管理员 Cookie 伪造。 比较有趣的是，利用的过程涉及到…
54 views