Confluence OGNL injection

Last update: Sep 23, 2022

Overview

CVE-2021-26084

Confluence OGNL injection

CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in the Atlassian Confluence Webwork implementation. An unauthenticated, remote attacker could exploit this flaw by sending a specially crafted request to vulnerable endpoints on the Confluence Server or Data Center instance. Successful exploitation would allow an attacker to execute arbitrary code.

Note - make sure to change the collaborator id.

Usage

python3 CVE-2021-26084.py http://target

Authors

• D0rkerDevil

This is for educational purposes, Authors are not responsible for any damages.

Owner

Ashish Kunwar

Researcher at RISKIQ | I deal with 0days and malwares

GitHub Repository

DirBruter is a Python based CLI tool. It looks for hidden or existing directories/files using brute force method. It basically works by launching a dictionary based attack against a webserver and analyse its response.

DirBruter DirBruter is a Python based CLI tool. It looks for hidden or existing directories/files using brute force method. It basically works by laun

12 Dec 17, 2022

Auerswald COMpact 8.0B Backdoors exploit

CVE-2021-40859 Auerswald COMpact 8.0B Backdoors exploit About Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow a

6 Sep 22, 2022

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

DependConfusion-X Tool is written in Python3 which allows security researcher/bug bounty hunter to scan and monitor list of hosts for Dependency Confusion.

4 Dec 21, 2021

A Burp Pro extension that adds log4shell checks to Burp Scanner

scan4log4shell A Burp Pro extension that adds log4shell checks to Burp Scanner, written by Daniel Crowley of IBM X-Force Red. Installation To install

26 Mar 15, 2022

Threat Intel Platform for T-POTs

GreedyBear The project goal is to extract data of the attacks detected by a TPOT or a cluster of them and to generate some feeds that can be used to p

72 Jan 01, 2023

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effec

2 Mar 23, 2022

A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java loggin

1.5k Jan 04, 2023

This script checks for any possible SSRF dns/http interactions in xmlrpc.php pingback feature

rpckiller This script checks for any possible SSRF dns/http interactions in xmlrpc.php pingback feature and with that you can further try to escalate

33 Sep 23, 2022

RedDrop is a quick and easy web server for capturing and processing encoded and encrypted payloads and tar archives.

RedDrop Exfil Server Check out the accompanying MaverisLabs Blog Post Here! RedDrop Exfil Server is a Python Flask Web Server for Penetration Testers,

53 Nov 01, 2022

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP top 10 https://owasp.org/www-project-top-ten/# as well as run a

1 Nov 12, 2021

this keylogger is only for pc not for android but it will only work on those pc who have python installed it is made for all linux,windows and macos

Keylogger this keylogger is only for pc not for android but it will only work on those pc who have python installed it is made for all linux,windows a

1 Nov 04, 2021

Confluence OGNL injection

Related tags

Overview

CVE-2021-26084

Note - make sure to change the collaborator id.

Usage

Authors

Owner

Ashish Kunwar

DirBruter is a Python based CLI tool. It looks for hidden or existing directories/files using brute force method. It basically works by launching a dictionary based attack against a webserver and analyse its response.

Auerswald COMpact 8.0B Backdoors exploit

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

A Burp Pro extension that adds log4shell checks to Burp Scanner

Threat Intel Platform for T-POTs

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability

This script checks for any possible SSRF dns/http interactions in xmlrpc.php pingback feature

RedDrop is a quick and easy web server for capturing and processing encoded and encrypted payloads and tar archives.

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP

this keylogger is only for pc not for android but it will only work on those pc who have python installed it is made for all linux,windows and macos

Auto Tor Ip Changer

an impacket-dependent script exploiting CVE-2019-1040

Log4Shell RCE Exploit - fully independent exploit does not require any 3rd party binaries.

Implementation of an attack on a tropical algebra discrete logarithm based protocol

A great and handy python obfuscator for protecting code.

Scan your logs for CVE-2021-44228 related activity and report the attackers

CC CAMERA HACKING TOOL

Sample exploits for Zephyr CVE-2021-3625

🐎🖥《赛马娘》（ウマ娘: Pretty Derby）辅助脚本