CVE-2021-26855 SSRF Exchange Server

Last update: Nov 28, 2022

Overview

CVE-2021-26855 Brute Force EMail Exchange Server

Timeline:

Monday, March 8, 2021: Update Dumping content...(I'm not done, can u guy help me done this code ;-;)

Tuesday, March 9, 2021: Remake to simple check valid mail

Wednesday, March 10, 2021: Maybe im done this script, now im waiting true cve pre-auth rce

Sometime, some server extract domain tld is wrong

Download users.txt list from github or u find it with Google Dork: intext:'@domain.ltd'

Shodan

https://beta.shodan.io/search?query=http.component%3A%22outlook+web+app%22
https://beta.shodan.io/search?query=http.html%3A%22%2Fowa%22

Fofa

https://fofa.so/result?q=title%3D%22Outlook+Web+App%22
https://fofa.so/result?q=%22%2Fowa%22&qbase64=Ii9vd2Ei
https://gist.githubusercontent.com/pikpikcu/fb604e01a7555adb1577a2fbc856022d/raw/ef3025f809c6ca87d22f01914b230d35f39c0ac2/fofa%2520dork-CVE-2021-26855.md

Zoomeye

https://www.zoomeye.org/searchResult?q=%2Fowa

Owner

lulz

retarded kid trying to use internet

GitHub Repository

HashDB API hash lookup plugin for IDA Pro

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms

237 Dec 21, 2022

Threat Intelligence Gathering 威胁情报收集，旨在提高蓝队拿到攻击 IP 后对其进行威胁情报信息收集的效率。

0x00 介绍 tig Threat Intelligence Gathering 威胁情报收集，旨在提高蓝队拿到攻击 IP 后对其进行威胁情报信息收集的效率，目前已集成微步、IP 域名反查、Fofa 信息收集、ICP 备案查询、IP 存活检测五个模块，现已支持以下信息的查询： ✅ 微步标签 ✅ I

698 Dec 09, 2022

Windows Stack Based Auto Buffer Overflow Exploiter

Autoflow - Windows Stack Based Auto Buffer Overflow Exploiter Autoflow is a tool that exploits windows stack based buffer overflow automatically.

19 Dec 22, 2022

A python script to bypass 403-forbidden.

4nought3 A python script to bypass 403-forbidden. It covers methods like Host-Header Injections, Changing HTTP Requests Methods and URL-Injections. Us

11 Aug 27, 2022

Jolokia Exploitation Toolkit (JET) helps exploitation of exposed jolokia endpoints.

jolokia-exploitation-toolkit Jolokia Exploitation Toolkit (JET) helps exploitation of exposed jolokia endpoints. Core concept Jolokia is a protocol br

194 Jan 01, 2023

Salesforce Recon and Exploitation Toolkit

Salesforce Recon and Exploitation Toolkit Salesforce Recon and Exploitation Toolkit Usage python3 main.py URL References Announcement Blog - https:/

81 Dec 23, 2022

Cloud One Container Security Runtime Events Forwarder

Example on how to query events by a RESTful API, compose CEF event format and send the events to an UDP receiver.

3 Feb 10, 2022

dos-atack-tor script de python que permite usar conexiones cebollas para atacar paginas .onion o paginas convencionales via tor.

script de python que permite usar conexiones cebollas para atacar paginas .onion o paginas convencionales via tor. tiene capacidad de ajustar la cantidad de informacion a enviar, el numero de hilos a

2 Jun 01, 2022

A piece of software that shows a traceroute of a URL redirect path

Tracing URL redirects has never been easier! Usage • Download 🚩 Use Cases To see where an affiliate link ends up To see what affiliate network is bei

41 Nov 22, 2022

Python DNS Lookup: The Domain Name System (DNS) is basically the phonebook of the Internet

-Python-DNS-Lookup- ✨ 🌟 Python DNS Lookup ✨ 🌟 The Domain Name System (DNS) is

2 Feb 14, 2022

DCSync - DCSync Attack from Outside using Impacket

Adding DCSync Permissions Mostly copypasta from https://github.com/tothi/rbcd-at

77 Dec 16, 2022

Finite Volume simulation of the Raleigh-Taylor Instability

finitevolume2-python Finite Volume simulation of the Raleigh-Taylor Instability Create Your Own Finite Volume Fluid Simulation (With Python): Part 2 B

12 Sep 01, 2022

simple python keylogger

HELLogger simple python keylogger DISCLAIMERS: DON'T DO BAD THINGS. THIS PROGRAM IS MEANT FOR PERSONAL USES ONLY. USE IT ONLY IN COMPUTERS WHERE YOU H

10 Nov 10, 2022

Osint-Tool - Information collection tool in python

Osint-Tool Herramienta para la recolección de información Pronto más opciones In

3 Apr 09, 2022

Log4j minecraft with python

Apache-Log4j Apache Log4j 远程代码执行攻击者可直接构造恶意请求，触发远程代码执行漏洞。漏洞利用无需特殊配置，经阿里云安全团队验证，Apache Struts2、Apache Solr、Apache Druid、Apache Flink等均受影响 Steps 【Import

57 Oct 03, 2022

PrivateRoom - Make your work private by building a system using arduino which instantly kills a program when someone enters your room/cabin

privateRoom Make your work private by building a system using arduino which instantly kills a program when someone enters your room/cabin STEPS: Uploa

3 Nov 08, 2022