CVE-2021-26855 SSRF Exchange Server

Last update: Nov 28, 2022

Overview

CVE-2021-26855 Brute Force EMail Exchange Server

Timeline:

Monday, March 8, 2021: Update Dumping content...(I'm not done, can u guy help me done this code ;-;)

Tuesday, March 9, 2021: Remake to simple check valid mail

Wednesday, March 10, 2021: Maybe im done this script, now im waiting true cve pre-auth rce

Sometime, some server extract domain tld is wrong

Download users.txt list from github or u find it with Google Dork: intext:'@domain.ltd'

Shodan

https://beta.shodan.io/search?query=http.component%3A%22outlook+web+app%22
https://beta.shodan.io/search?query=http.html%3A%22%2Fowa%22

Fofa

https://fofa.so/result?q=title%3D%22Outlook+Web+App%22
https://fofa.so/result?q=%22%2Fowa%22&qbase64=Ii9vd2Ei
https://gist.githubusercontent.com/pikpikcu/fb604e01a7555adb1577a2fbc856022d/raw/ef3025f809c6ca87d22f01914b230d35f39c0ac2/fofa%2520dork-CVE-2021-26855.md

Zoomeye

https://www.zoomeye.org/searchResult?q=%2Fowa

Owner

lulz

retarded kid trying to use internet

GitHub Repository

wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

WSVuls Website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.] What's WSVuls? WSVuls is a simple and powerf

47 Sep 22, 2022

BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC (Full) Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user

17 Nov 09, 2022

PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

yLog4j This is Y-Sec's @PortSwigger Burp Plugin for the Log4j CVE-2021-44228 vulnerability. The focus of yLog4j is to support mass-scanning of the Log

1 Jan 31, 2022

An All-In-One Pure Python PoC for CVE-2021-44228

Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-44228. Configure Replace the global variables at the top of the script to your configuratio

178 Nov 09, 2022

A small utility to deal with malware embedded hashes.

Uchihash is a small utility that can save malware analysts the time of dealing with embedded hash values used for various things such as: Dyn

48 Dec 19, 2022

Discord-keylogger - Discord keylogger With Python

Discord-keylogger Usage python dlogger.py -t [Time interval in sec] if not speci

1 Jan 30, 2022

Spring4Shell - Spring Core RCE - CVE-2022-22965

Spring Core RCE - CVE-2022-22965 After Spring Cloud, on March 29, another heavyweight vulnerability of Spring broke out on the Internet: Spring Core R

118 Dec 31, 2022

A python script written for lazy people to hack their school systen ;D

F-ck-the-system A python script written for lazy people to hack their school systen ;D Python voice notes writer This is a python script to record you

2 Jan 09, 2022

Security tool to test different bypass of forbidden

notForbidden Security tool to test different bypass of forbidden Usage python3 notForbidden.py URL Features Bypass with different methods (POST, OPT

6 Sep 08, 2022

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities Features 1 Scan one website 2 Scan multiple websites Insta

9 Dec 30, 2022

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

sshuttle: where transparent proxy meets VPN meets ssh As far as I know, sshuttle is the only program that solves the following common case: Your clien

9.4k Jan 04, 2023

CVE-2021-26855 SSRF Exchange Server

Related tags

Overview

CVE-2021-26855 Brute Force EMail Exchange Server

Timeline:

Shodan

Fofa

Zoomeye

Owner

lulz

wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

An All-In-One Pure Python PoC for CVE-2021-44228

A small utility to deal with malware embedded hashes.

Discord-keylogger - Discord keylogger With Python

Spring4Shell - Spring Core RCE - CVE-2022-22965

A python script written for lazy people to hack their school systen ;D

Security tool to test different bypass of forbidden

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

Python library to prevent XSS(cross site scripting attach) by removing harmful content from data.

Getting my gitlab commit history into github

CVE-2021-44228 log4j 2.x rce漏洞检测工具

script that pulls cve collections from NVD.NIST.GOV.

BurpSuite Extension: Log4j RCE Scanner

Scarecrow is a tool written in Python3 allowing you to protect your Python3 scripts.

Dapunta Multi Brute Force Facebook - Crack Facebook With Login - Free

PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)