This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Overview

PYTHON-EXPLOITATION

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Networking

tcp_clinet.py

The tcp_clinet.py script is used to push data to a server in the event that you are not able to use the typical networking tools. In the script we:

  • Create a socket object (line 8): the AF_INET parameter indicates we will use a standard IPv4 address or hostname, and SOCK_STREAM indicates that this will be a TCP client.
  • Connect to the client server (line 11): note that, since we are using a TCP client, we must first connect to our server (via the TCP handshake) to send data to it.
  • Send the server some data in bytes (line 14)
  • Recieve data back from the server and print out the response (line 17)

    Note that this script makes numerous assumptions about the server we are engaging with:

  • It assumes that our connection will always succeed as it does not have a fallback function in the event that the server rejects our connection.
  • It assumes that the server expects us to send data first. Sometimes, the server will want to send us data first - this is especially true if the server is being guarded by a firewall of some kind.
  • The script assumes that the server will always return data to us in a timely fashion.

    The assumptions are made for simplicity's sake. All things considered, sometimes less is more.

    udp_client.py

    Our udp_client.py script is much different from our tcp script, only that it it configured to send data via the user datagram protocol (but that much was obvious):

    • We change the socket type to SOCK_DGRAM to indicate that we will be using sending data via the UDP (line 6).
    • Also, notice that there is no connect() method beforehand, since we do not need to connect to a server beforehand using UDP. This is because UDP is a connectionaless protocol.
    • The last step is to call the recvfrom() method to receive UDP data back. This returns both the data and the details of the remote host and port (line 9).

    tcp_server.py

    The tcp_server.py is just that, a multi-threaded python TCP server that we can use in the event we want to write a command shell or craft a proxy.

    • Firstly, we pass in the IP address and port we want the server to listen on (line 9).
    • Next, we tell the server to simply start listening with a max backlog of connections set to 5 (line 10). Now ther server waits for a connection.
    • Once the clinet connects, we get the client socket in the client variable and the remote connection details in teh address variable.
    • We tehn start the thread to handle the client connection (line 17).
    • The handle_client function performs rec() and then sens a simple message back to the client.
  • Owner
    Nathan Galindo
    Hi, my name is Nathan Galindo and I am a cybersecurity student at Baylor University!
    Nathan Galindo
    Jolokia Exploitation Toolkit (JET) helps exploitation of exposed jolokia endpoints.

    jolokia-exploitation-toolkit Jolokia Exploitation Toolkit (JET) helps exploitation of exposed jolokia endpoints. Core concept Jolokia is a protocol br

    Laluka 194 Jan 01, 2023
    带回显版本的漏洞利用脚本

    CVE-2021-21978 带回显版本的漏洞利用脚本,更简单的方式 0. 漏洞信息 VMware View Planner Web管理界面存在一个上传日志功能文件的入口,没有进行认证且写入的日志文件路径用户可控,通过覆盖上传日志功能文件log_upload_wsgi.py,即可实现RCE 漏洞代码

    3ky7in4 24 Nov 09, 2022
    Generate your own NFTs and their metadata based on your desired probabilities.

    Generate your own NFTs and their metadata based on your desired probabilities. Use your own art assets too! Perfect for use with Candy Machine.

    hex 7 Sep 16, 2022
    Threat research and reporting from IronNet's Threat Research Teams

    IronNet Threat Research 🕵️ Overview This repository contains IronNet's Threat Research. Research & Reporting 📝 Project Description Cobalt Strike Res

    36 Dec 02, 2022
    Course: Information Security with Python

    Curso: Segurança da Informação com Python Curso realizado atravès da Plataforma da Digital Innovation One Prof: Bruno Dias Conteúdo: Introdução aos co

    Elizeu Barbosa Abreu 1 Nov 28, 2021
    exchange-ssrf-rce

    Usage python3 .\exchange-exp.py -------------------------------------------------------------------------------- |

    Jen 76 Nov 09, 2022
    Python Toolkit containing different Cyber Attacks Tools

    Helikopter Python Toolkit containing different Cyber Attacks Tools. Tools in Helikopter Toolkit 1. FattyNigger (PYTHON WORM) 2. Taxes (PYTHON PASS EXT

    Saqlain Naqvi 22 Dec 04, 2022
    解密哥斯拉webshell管理工具流量

    kingkong 解密哥斯拉Godzilla-V2.96 webshell管理工具流量 目前只支持jsp类型的webshell流量解密 Usage 获取攻击者上传到服务器的webshell样本 获取wireshark之类的流量包,一般甲方有科来之类的全流量镜像设备,联系运维人员获取,这里以test.

    h4ck for fun 46 Dec 21, 2022
    Windows Stack Based Auto Buffer Overflow Exploiter

    Autoflow - Windows Stack Based Auto Buffer Overflow Exploiter Autoflow is a tool that exploits windows stack based buffer overflow automatically.

    Himanshu Shukla 19 Dec 22, 2022
    A python script to decrypt media files encrypted using the Android application 'Decrypting 'LOCKED Secret Calculator Vault''. Will identify PIN / pattern.

    A python script to decrypt media files encrypted using the Android application 'Decrypting 'LOCKED Secret Calculator Vault''. Will identify PIN / pattern.

    3 Sep 26, 2022
    Spring4Shell - Spring Core RCE - CVE-2022-22965

    Spring Core RCE - CVE-2022-22965 After Spring Cloud, on March 29, another heavyweight vulnerability of Spring broke out on the Internet: Spring Core R

    Malte Gejr 118 Dec 31, 2022
    Credit Card And SK Checker Written In Python

    💳 Credit Card Checker (CC Checker) & Mass SK Checker & Generator 💳

    Rimuru Tempest 53 Dec 31, 2022
    The disassembler parses evm bytecode from the command line or from a file.

    EVM Bytecode Disassembler The disassembler parses evm bytecode from the command line or from a file. It does not matter whether the bytecode is prefix

    alpharush 22 Dec 27, 2022
    An All-In-One Pure Python PoC for CVE-2021-44228

    Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-44228. Configure Replace the global variables at the top of the script to your configuratio

    Alexandre Lavoie 178 Nov 09, 2022
    This repository detects a system vulnerable to CVE-2022-21907 and protects against this vulnerability if desired

    This repository detects a system vulnerable to CVE-2022-21907 and protects against this vulnerability if desired

    26 Dec 26, 2022
    FIVE, Vulnerability Scanner And Mass Exploiter, made for pentesting.

    $ FIVE - FIVE is a Pentesting Framework to Test the Security & Integrity of a Website, or Multiple Websites. $ Info FIVE Was Made After Vulnnr to Prod

    Neon 24 Dec 10, 2021
    SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

    SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effec

    Ty K 2 Mar 23, 2022
    This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device

    f5-waf-enforce-sigs-CVE-2021-44228 This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device Overview This script enforce

    Ismael Gonçalves 5 Mar 31, 2022