Rce Open Source Projects

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

Top disclosed reports from HackerOne

SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

一个好玩的Web安全-漏洞测试平台

Automatic SSRF fuzzer and exploitation tool

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

Java web common vulnerabilities and security code which is base on springboot and spring security

红队作战中比较常遇到的一些重点系统漏洞整理。

JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

利用大量高威胁poc/exp快速获取目标权限，用于渗透和红队快速打点

The best tool for finding one gadget RCE in libc.so.6

Collection of quality safety articles. Awesome articles.

Notes about attacking Jenkins servers

Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Awesome list of step by step techniques to achieve Remote Code Execution on various apps!

Penelope Shell Handler

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)

Automatic SSTI detection tool with interactive interface

Miscellaneous exploit code

Popular Pentesting scanner in Python3.6 for SQLi/XSS/LFI/RFI and other Vulns

Attack surface mapping

Check your WAF before an attacker does

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep

This is a collection of writeups, cheatsheets, videos, books related to SSRF in one single location

Compilation of commands, tips and scripts that helped me throughout Vulnhub, Hackthebox, OSCP and real scenarios

A DNS rebinding attack framework.

thinkphp v5.x 远程代码执行漏洞-POC集合

Redis(<=5.0.5) RCE

A malicious LDAP server for JNDI injection attacks

Java RCE 回显测试代码

Redis 4.x/5.x RCE

Getting started with java code auditing 代码审计入门的小项目

Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs

CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit

A powerful PHP WAF for AWD

Issues has been disabled for these PoC's, as they are simply PoC, Public Domain and unsupported.

spring boot Fat Jar 任意写文件漏洞到稳定 RCE 利用技巧

The exploit samples database is a repository for **RCE** (remote code execution) exploits and Proof-of-Concepts for **WINDOWS**, the samples are uploaded for education purposes for red and blue teams.

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

在渗透测试中快速检测常见中间件、组件的高危漏洞。

Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other payload to victim without any complex configuration.

OSWE Preparation

A curated list of awesome resources about Electron.js (in)security

一个旨在通过应用场景 / 标签对 Github 红队向工具 / 资源进行分类收集，降低红队技术门槛的手册【持续更新】

for mass exploiting

There is no pre-auth RCE in Jenkins since May 2017, but this is the one!

Automatically identify deserialisation issues in Java and .NET applications by using active and passive scans

Redis 4.x/5.x RCE

CVE-2020-0796 Remote Code Execution POC

CVE-2020-0796 Remote Code Execution POC

RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetration.