Unauthenticated Sqlinjection that leads to dump data base but this one impersonated Admin and drops a interactive shell

Last update: Nov 09, 2022

Overview

CVE-2021-32099 Pandora_v7.0NG.742

Unauthenticated Sqlinjection that leads to dump database but this one impersonated Admin and drops a interactive shell

Official Blog by the Author

Blog https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained

Usage :

usage: sqlpwn.py [-h] -t TARGET [-f FILENAME]

Exploiting Sqlinjection To impersonate Admin

optional arguments:
-h, --help            show this help message and exit
-t TARGET, --target TARGET
                      Host Ip for the Exploiting with target Port 
-f FILENAME, --filename FILENAME
                      Filename for Shell Upload with php extension

Owner

sam

Pentester | fsociety

GitHub Repository

This repository uses a mixture of numbers, alphabets, and other symbols found on the computer keyboard

This repository uses a mixture of numbers, alphabets, and other symbols found on the computer keyboard to form a 16-character password which is unpredictable and cannot easily be memorised.

1 Nov 23, 2021

NS-LOOKUP - A python script for scanning website for getting ip address of a website

NS-LOOKUP A python script for scanning website for getting ip address of a websi

5 Aug 02, 2022

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

The Devil's Eye searches the darkweb for information relating to the user's query and returns the results including .onion links and their description

135 Dec 31, 2022

Fat-Stealer is a stealer that allows you to grab the Discord token from a user and open a backdoor in his machine.

21 Jan 01, 2023

Mass Check Vulnerable Log4j CVE-2021-44228

Log4j-CVE-2021-44228 Mass Check Vulnerable Log4j CVE-2021-44228 Introduction Actually I just checked via Vulnerable Application from https://github.co

6 Dec 28, 2022

Simulating Log4j Remote Code Execution (RCE) vulnerability in a flask web server using python's logging library with custom formatter that simulates lookup substitution by executing remote exploit code.

py4jshell Simulating Log4j Remote Code Execution (RCE) CVE-2021-44228 vulnerability in a flask web server using python's logging library with custom f

86 Aug 21, 2022

Unauthenticated Sqlinjection that leads to dump data base but this one impersonated Admin and drops a interactive shell

Related tags

Overview

CVE-2021-32099 Pandora_v7.0NG.742

Official Blog by the Author

Owner

sam

This repository uses a mixture of numbers, alphabets, and other symbols found on the computer keyboard

NS-LOOKUP - A python script for scanning website for getting ip address of a website

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

Fat-Stealer is a stealer that allows you to grab the Discord token from a user and open a backdoor in his machine.

Mass Check Vulnerable Log4j CVE-2021-44228

Simulating Log4j Remote Code Execution (RCE) vulnerability in a flask web server using python's logging library with custom formatter that simulates lookup substitution by executing remote exploit code.

PySharpSphere - Inspired by SharpSphere, just another python version

AttractionFinder - 2022 State Qualified FBLA Attraction Finder Application

Tools for investigating Log4j CVE-2021-44228

This script allows you to make a onion host instantly.

Kunyu, more efficient corporate asset collection

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP Server)

Python3 script for scanning CVE-2021-44228 (Log4shell) vulnerable machines.

BurpSuite Extension: Log4j2 RCE Scanner

CodeTest信息收集和漏洞利用工具

Anti-Nuke capabilities, powerful moderation features, auto punishments, captcha-verification and more.

Open-source keylogger write in python

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

MTBLLS Ethical Hacking Tool Announcement of v2.0

Brute smb share - Brute force a SMB share