棱角社区 – Telegram

棱角社区

83 subscribers

12 photos

444 links

网络安全事件推送.

Download Telegram

About

Blog

Apps

Platform

#工具基于浏览器的快速网络发现模块

https://github.com/serain/netmap.js

GitHub - serain/netmap.js: Fast browser-based network discovery module

Fast browser-based network discovery module. Contribute to serain/netmap.js development by creating an account on GitHub.

54 views12:21

#工具 FuzzingTool：Web渗透测试工具
https://github.com/NESCAU-UFLA/FuzzingTool

GitHub - NESCAU-UFLA/FuzzingTool: Software for fuzzing, used on web application pentestings.

Software for fuzzing, used on web application pentestings. - NESCAU-UFLA/FuzzingTool

55 views13:59

#bountytip 403 Forbidden Page Bypass — Rare Exploitation of frequently seen Vulnerability
https://uduthalavankumar.medium.com/403-forbidden-page-bypass-rare-exploitation-of-frequently-seen-vulnerability-ee16c434add7

56 views15:44

#工具 swagger-exp Swagger REST API 信息泄露利用工具
https://github.com/lijiejie/swagger-exp

GitHub - lijiejie/swagger-exp: A Swagger API Exploit

A Swagger API Exploit. Contribute to lijiejie/swagger-exp development by creating an account on GitHub.

48 views11:24

#漏洞 Apache OFBiz RMI反序列化任意代码执行（CVE-2021-26295） PoC：
https://www.o2oxy.cn/3271.html

CVE-2021-26295 Apache OFBiz rmi反序列化漏洞复现 - print("")

一、环境搭建

51 views11:47

#漏洞 Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）
https://github.com/projectdiscovery/nuclei-templates/pull/1128/files

Added CVE-2021-21087 by Daviey · Pull Request #1128 · projectdiscovery/nuclei-templates

Vulnerability in Adobe ColdFusion which is improper input
validation which leads to arbitrary code execution.
Signed-off-by: Dave Walker (Daviey) email@daviey.com

52 views11:48

#漏洞 [CVE-2021-21123] Google Chrome Bug Bounty $5.000 File System Access API - vulnerabilities
https://github.com/Puliczek/CVE-2021-21123-PoC-Google-Chrome

GitHub - Puliczek/CVE-2021-21123-PoC-Google-Chrome: 🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by…

🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more... - Puliczek/CVE-2021-21123-PoC-Google-Ch...

51 views11:51

#漏洞 MobileIron MDM Contains Static Key Allowing Account Enumeration

https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration

MobileIron MDM Contains Static Key Allowing Account Enumeration

MobileIron MDM exposes account enumeration and SFA to unauthenticated attacks. This analysis details how to mitigate this vulnerability.

53 views01:30

#漏洞 ntopng 流量分析工具多个漏洞分析
http://noahblog.360.cn/ntopng-multiple-vulnerabilities/

root@cyberworld:~# Noah Lab

ntopng 流量分析工具多个漏洞分析

0x00. TL;DRntopng 是一套开源的网络流量监控工具，提供基于 Web 界面的实时网络流量监控。支持跨平台，包括 Windows、Linux 以及 MacOS。ntopng 使用 C++ 语言开发，其绝大部分 Web 逻辑使用 lua 开发。在针对 ntopng 的源码进行审计的过程中，笔者发现了 ntopng 存在多个漏洞，包括一个权限绕过漏洞、一个 SSRF 漏洞和多个其他安全问题，接着组合利用这些问题成功实现了部分版本的命令执行利用和管理员 Cookie 伪造。比较有趣的是，利用的过程涉及到…

54 views04:09

#bountytip H2C Smuggling in the Wild
https://blog.assetnote.io/2021/03/18/h2c-smuggling/

52 views04:28

#工具 Email sender spoofing test tools

https://github.com/mo-xiaoxi/EmailSpoofingTestTool

GitHub - mo-xiaoxi/ESpoofing: A fuzzing tool for email sender spoofing attack. 👻

A fuzzing tool for email sender spoofing attack. 👻 - GitHub - mo-xiaoxi/ESpoofing: A fuzzing tool for email sender spoofing attack. 👻

52 views07:01

#工具 weblogic利用工具weblogic-framework
https://github.com/0nise/weblogic-framework

52 views12:10

#漏洞 ThinkPHP v6.0.7 eval反序列化利用链

https://xz.aliyun.com/t/9310

53 views14:33

#漏洞这是一篇“不一样”的真实渗透测试案例分析文章
https://www.secpulse.com/archives/125869.html

这是一篇“不一样”的真实渗透测试案例分析文章 - SecPulse.COM | 安全脉搏

作者：cheery@QAX-ATEAM && n0thing@QAX-ATEAM

53 views16:39

#漏洞 CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds
https://iamelli0t.github.io/2021/03/25/CVE-2021-1732.html

iamelli0t’s blog

CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds

CVE-2021-1732 is a 0-Day vulnerability exploited by the BITTER APT organization in one operation which was disclosed in February this year[1][2][3]. This vulnerability exploits a user mode callback opportunity in win32kfull module to break the normal execution…

51 views06:19

#漏洞蓝凌OA EKP 后台SQL注入漏洞 CNVD-2021-01363
https://mp.weixin.qq.com/s/jnmB8h9UCztt-FL3aKmn0g

Weixin Official Accounts Platform

蓝凌OA EKP 后台SQL注入漏洞 CNVD-2021-01363

师傅们，0day来啦~\x0a蓝凌OA EKP 后台SQL注入漏洞 CNVD-2021-01363

51 views06:23

Hidden OAuth attack vectors
https://portswigger.net/research/hidden-oauth-attack-vectors

PortSwigger Research

Hidden OAuth attack vectors

Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an

56 views07:22

#漏洞海康威视流媒体管理服务器任意文件读取/通用弱口令 CNVD-2021-14544

54 views08:06

#漏洞 CVE-2021-26871_POC

https://github.com/robotMD5/CVE-2021-26871_POC

GitHub - robotMD5/CVE-2021-26871_POC: POC for CVE-2021-26871(Maybe)

POC for CVE-2021-26871(Maybe). Contribute to robotMD5/CVE-2021-26871_POC development by creating an account on GitHub.

53 views11:45

#工具 OSINT tool to get information from a Github and Gitlab profile and find user's email addresses leaked on commits.
从Github或Gitlab配置文件中获取信息，并查找提交时泄露的用户电子邮件地址。

https://github.com/GONZOsint/gitrecon

GitHub - GONZOsint/gitrecon: OSINT tool to get information from a Github and Gitlab profile and find user's email addresses leaked…

OSINT tool to get information from a Github and Gitlab profile and find user's email addresses leaked on commits. - GONZOsint/gitrecon

52 views11:47

#漏洞 Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc

https://github.com/xiaopan233/Mybb-XSS_SQL_RCE-POC

GitHub - xiaopan233/Mybb-XSS_SQL_RCE-POC: Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc

Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc - GitHub - xiaopan233/Mybb-XSS_SQL_RCE-POC: Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc

51 views11:48