Latest Exploits / Tools

Latest Exploits

  • Fri, 29 May 2015 22:22:22 +0000: Realtek SDK Miniigd UPnP SOAP Command Execution - Exploit Files ≈ Packet Storm
    Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This Metasploit module has been tested successfully on a Trendnet TEW-731BR router with emulation.
  • Fri, 29 May 2015 20:02:22 +0000: Airties login-cgi Buffer Overflow - Exploit Files ≈ Packet Storm
    This Metasploit module exploits a remote buffer overflow vulnerability on several Airties routers. The vulnerability exists in the handling of HTTP queries to the login cgi with long redirect parameters. The vulnerability doesn't require authentication. This Metasploit module has been tested successfully on the AirTies_Air5650v3TT_FW_1.0.2.0.bin firmware with emulation. Other versions such as the Air6372, Air5760, Air5750, Air5650TT, Air5453, Air5444TT, Air5443, Air5442, Air5343, Air5342, Air5341, Air5021 are also reported as vulnerable.
  • Fri, 29 May 2015 19:32:22 +0000: D-Link Devices UPnP SOAPAction-Header Command Execution - Exploit Files ≈ Packet Storm
    Different D-Link Routers are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This Metasploit module has been tested on a DIR-645 device. The following devices are also reported as affected: DAP-1522 revB, DAP-1650 revB, DIR-880L, DIR-865L, DIR-860L revA, DIR-860L revB DIR-815 revB, DIR-300 revB, DIR-600 revB, DIR-645, TEW-751DR, TEW-733GR
  • Fri, 29 May 2015 17:22:22 +0000: Flash Timing Side-Channel Data Exfiltration - Exploit Files ≈ Packet Storm
    Flash by design allows local SWF files to read arbitrary local files, but prevents communication with remote servers. By smuggling data through a timing side-channel, this can be circumvented, allowing local SWF files to exfiltrate the contents of arbitrary local files to the internet.
  • Fri, 29 May 2015 15:55:55 +0000: ESC 8832 Data Controller Session Hijacking - Exploit Files ≈ Packet Storm
    ESC 8832 suffers from insecure user session handling and generation as well as interception and user management issues.
  • Fri, 29 May 2015 14:04:44 +0000: Sypex Dumper 2.0.11 Cross Site Scripting - Exploit Files ≈ Packet Storm
    Sypex Dumper version 2.0.11 suffers from multiple cross site scripting vulnerabilities.
  • Fri, 29 May 2015 06:26:03 +0000: JSPAdmin 1.1 SQL Injection / CSRF / Cross Site Scripting - Exploit Files ≈ Packet Storm
    JSPAdmin version 1.1 suffers from cross site request forgery, cross site scripting, and remote SQL injection vulnerabilities.
  • Fri, 29 May 2015 06:07:38 +0000: 22 SOHO Router Vulnerabilities Discovered - Exploit Files ≈ Packet Storm
    SOHO routers have been found vulnerable to privilege escalation, information disclosure, cross site request forgery, cross site scripting, authentication bypass, denial of service, and various other vulnerabilities.
  • Fri, 29 May 2015 04:44:44 +0000: Invision Power Board 3.4.7 SQL Injection - Exploit Files ≈ Packet Storm
    Invision Power Board versions 3.4.7 and below suffer from a remote SQL injection vulnerability.
  • Fri, 29 May 2015 03:33:33 +0000: Vevocart 6.1.0 Open Redirect - Exploit Files ≈ Packet Storm
    Vevocart version 6.1.0 suffers from an open redirection vulnerability.
  • Thu, 28 May 2015 22:22:22 +0000: IBM Cognos Business Intelligence Developer 10.2.1 Open Redirect - Exploit Files ≈ Packet Storm
    IBM Cognos Business Intelligence Developer version 10.2.1 suffers from an open redirect vulnerability.
  • Thu, 28 May 2015 10:22:22 +0000: IBM Lotus Domino 8.5.4 / 8.5.3 Cross Site Scripting - Exploit Files ≈ Packet Storm
    IBM Lotus Domino versions 8.5.3 and 8.5.4 suffer from a cross site scripting vulnerability.
  • Thu, 28 May 2015 04:44:44 +0000: Audacity 2.0.5 DLL Hijack - Exploit Files ≈ Packet Storm
    Audacity version 2.0.5 suffers from a dll hijacking vulnerability.
  • Wed, 27 May 2015 20:22:22 +0000: hwclock Privilege Escalation - Exploit Files ≈ Packet Storm
    hwclock on Linux, when setuid, allows for local root-level privilege escalation.
  • Wed, 27 May 2015 20:02:22 +0000: WordPress Free Counter 1.1 Cross Site Scripting - Exploit Files ≈ Packet Storm
    WordPress Free Counter plugin version 1.1 suffers from a cross site scripting vulnerability.
  • Wed, 27 May 2015 17:02:22 +0000: DbNinja Flash 3.2.6 Cross Site Scripting - Exploit Files ≈ Packet Storm
    DbNinja Flash version 3.2.6 suffers from multiple cross site scripting vulnerabilities.
  • Wed, 27 May 2015 15:05:55 +0000: SOPHOS WAF JSON Filter Bypass - Exploit Files ≈ Packet Storm
    SOPHOS WAF fails to mitigate SQL injection attacks leveraged via JSON.
  • Wed, 27 May 2015 14:02:22 +0000: WordPress WP Fast Cache 1.4 CSRF / Cross Site Scripting - Exploit Files ≈ Packet Storm
    WordPress WP Fast Cache plugin version 1.4 suffers from cross site request forgery and cross site scripting vulnerabilities.
  • Wed, 27 May 2015 10:22:22 +0000: Aruba ClearPass Policy Manager 6.4 Cross Site Scripting - Exploit Files ≈ Packet Storm
    Aruba ClearPass Policy Manager version 6.4 suffers from a stored cross site scripting vulnerability.
  • Tue, 26 May 2015 10:02:22 +0000: extjs Arbitrary File Read - Exploit Files ≈ Packet Storm
    extjs suffers from an arbitrary file read vulnerability.

Latest Tools

  • Fri, 29 May 2015 15:55:55 +0000: Smart PCAP Replay 1.0 - Security Tool Files ≈ Packet Storm
    This is a tool to replay packet captures and simulate client/server models when doing analysis. Written in Python.
  • Tue, 26 May 2015 23:23:23 +0000: Packet Fence 5.1.0 - Security Tool Files ≈ Packet Storm
    PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
  • Mon, 25 May 2015 11:11:11 +0000: OATH Toolkit 2.6.0 - Security Tool Files ≈ Packet Storm
    OATH Toolkit attempts to collect several tools that are useful when deploying technologies related to OATH, such as HOTP one-time passwords. It is a fork of the earlier HOTP Toolkit.
  • Mon, 25 May 2015 09:02:22 +0000: INURLBR Search Scanner 2.1.0 - Security Tool Files ≈ Packet Storm
    INURL is a php tool written to make searching across multiple engines easier when researching web site targets.
  • Mon, 25 May 2015 04:44:44 +0000: UFONet 0.5b - Security Tool Files ≈ Packet Storm
    UFONet is a tool designed to launch DDoS attacks against a target, using open redirection vectors on third party web applications.
  • Fri, 22 May 2015 23:03:33 +0000: AIEngine 1.2 - Security Tool Files ≈ Packet Storm
    AIEngine is a packet inspection engine with capabilities of learning without any human intervention. It helps network/security professionals to identify traffic and develop signatures for use them on NIDS, Firewalls, Traffic classifiers and so on.
  • Fri, 22 May 2015 20:02:22 +0000: TOR Virtual Network Tunneling Tool 0.2.6.8 - Security Tool Files ≈ Packet Storm
    Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).
  • Fri, 22 May 2015 10:18:22 +0000: HostBox SSH 0.3 - Security Tool Files ≈ Packet Storm
    HostBox SSH is a python script will scan servers and routers for insecure SSH configurations.
  • Sat, 16 May 2015 23:02:22 +0000: FTP-Map 0.5 - Security Tool Files ≈ Packet Storm
    Ftpmap scans remote FTP servers to identify what software and what versions they are running. It uses program-specific fingerprints to discover the name of the software even when banners have been changed or removed, or when some features have been disabled. also FTP-Map can detect vulnerable servers by the FTP software/version.
  • Wed, 13 May 2015 18:00:17 +0000: Wireshark Analyzer 1.12.5 - Security Tool Files ≈ Packet Storm
    Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.
  • Mon, 11 May 2015 19:22:22 +0000: Netsniff-NG High Performance Sniffer 0.5.9 - Security Tool Files ≈ Packet Storm
    netsniff-ng is is a free, performant Linux network sniffer for packet inspection. The gain of performance is reached by 'zero-copy' mechanisms, so that the kernel does not need to copy packets from kernelspace to userspace. For this purpose netsniff-ng is libpcap independent, but nevertheless supports the pcap file format for capturing, replaying and performing offline-analysis of pcap dumps. netsniff-ng can be used for protocol analysis, reverse engineering and network debugging.
  • Fri, 08 May 2015 15:42:15 +0000: Capstone 3.0.3 - Security Tool Files ≈ Packet Storm
    Capstone is a multi-architecture, multi-platform disassembly framework. It has a simple and lightweight architecture-neutral API, thread-safe by design, provides details on disassembled instruction, and more.
  • Fri, 08 May 2015 04:44:44 +0000: DAVOSET 1.2.4 - Security Tool Files ≈ Packet Storm
    DAVOSET is a tool for committing distributed denial of service attacks using execution on other sites.
  • Thu, 07 May 2015 16:21:08 +0000: Faraday 1.0.10 - Security Tool Files ≈ Packet Storm
    Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.
  • Thu, 07 May 2015 02:06:42 +0000: Suricata IDPE 2.0.8 - Security Tool Files ≈ Packet Storm
    Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.
  • Tue, 05 May 2015 19:42:23 +0000: TOR Virtual Network Tunneling Tool 0.2.6.7 - Security Tool Files ≈ Packet Storm
    Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).
  • Tue, 05 May 2015 19:27:24 +0000: mrtparse MRT Parsing Tool 1.2 - Security Tool Files ≈ Packet Storm
    mrtparse is a module to read and analyze the MRT format data. The MRT format data can be used to export routing protocol messages, state changes, and routing information base contents, and is standardized in RFC6396. Programs like Quagga / Zebra, BIRD, OpenBGPD and PyRT can dump the MRT format data. Written in Python.
  • Mon, 04 May 2015 22:20:33 +0000: Packet Fence 5.0.2 - Security Tool Files ≈ Packet Storm
    PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
  • Mon, 04 May 2015 21:41:48 +0000: cryptmount Filesystem Manager 5.1 - Security Tool Files ≈ Packet Storm
    cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
  • Sun, 03 May 2015 10:11:11 +0000: Xpl-SHELLSHOCK-Ch3ck Shellshock Vulnerability Scanner - Security Tool Files ≈ Packet Storm
    PHP script that leverages user agents to scan for the shellshock vulnerability.

@Risk Exploits

  • : SANSFIRE 2011 - @RISK: The Consensus Security Alert
    SANSFIRE 2011

ExploitDB