项目说明
A collection of exploits de by
.exe GMON SEH O ExploitFreeFloat FTP Server HOST Buffer O (ASLR Bypass)CoolPlayer+ Portable 2.19.6 Stack O (ASLR Bypass) HTTPoxy Exploit/PoC ScannerAbility FTP 2.34 Buffer O ExploitAruba AP-205 Buffer O Denial of Service PoCBrainpan1 CTF Buffer O ExploitCesarFTP 0.99g Buffer O ExploitApache 2.2.x Range Header Denial of Service ExploitGHOST Glibc Gethostbyname Buffer O ExploitPHP Serialization Injection Remote Code Execution ExploitCrikeyConCTF Koala Gallery ExploitWebmin 1.920 Unauthenticated RCE Metasploit ExploitBug Bounty Profiles
Public Exploits
Blogs
Social Media
Websites
Public Exploits/PoC's/CVE's/Bug Bounties/CTF's
2018:
Featured in Hackin9 Magazine - Open Source Hacking Tools edition () 8/2018Jetty 6.1.6 Cross-Site Scripting (XSS) () (Full Disclosure) 8/2018Listed on the DoD Defense Tra HoF 6/2018Pre-qualified for the BugCrowd 2018 M list () 4/2018C Synology-SA-18:14 - Reflected XSS in DSM 6.1.5-15254 () 3/2018C Ipswitch MoveIt v8.1 Stored Cross-Site Scripting (XSS) () 2/2018Multiple Cross-Site Scripting (XSS) in Illustra IP Cameras ($600 bounty) 2/2018Directory Tra in Illustra IP Cameras ($800 bounty) 2/2018Remote Command Execution in Illustra IP Cameras ($900 bounty) 2/2018Listed on the BugCrowd 2017 M list () 1/20182017:
Recie Security Certified Expert (OSCE) cerfication 12/2017Multiple Cross-Site Request Forgery (CSRF) in WEMO HomeKit Bridge ($3,000 bounty) 9/2017Stored Cross-Site Scripting (XSS) in WEMO HomeKit Bridge ($500 bounty) 9/2017Systemic Stored XSS in WEMO HomeKit Android Application ($1,500 bounty) 9/2017Systemic Local File Inclusion in DEMO HomeKit Android Application ($3,000 bounty) 9/2017Placed 7th in ToorConCTF CTF 8/2017Stored XSS in ModSecurity App for Splunk (Full Disclosure) 8/2017Directory Tra in PSPDFKit/Atlassian Jira Cloud Android application Bug Bounty 7/2017Recie Security For Penetration Testers (ASFP) certification from SecurityTube 5/2017Gave talk at ISSA/OWASP Phoenix to 90+ attendees titled "Man In The Browser Ad Client Side Exploitation" () 4/2017PS: Cross-Site Tracing in NETGEAR Arlo CVE 2/2017Directory tra + multiple CSRF + multiple stored and reflected XSS in NETGEAR M4300-8X8F switches ($3,000+ bounty) 3/2017Recie of Defense HackerOne Challenge coin for the Hack The Army Bug Bounty Program 2/2017Listed on the BugCrowd 2016 MVP list 1/20172016:
Placed 3rd on BugCrowd's Operation Code CTF 9/20161st place CMD+CTRL CTF 8/2016HTTPoxy Exploit Scanner Exploit/PoC 7/2016C Zabbix SQL Injection 0day (www.c.com/c/) 7/2016C Unauthenticated Database Credential Leak in Aruba ClearPass ($1,500 bounty) () 6/2016Tied for 2nd place in BugCrowd Operation Code CTF 6/2016Made the top 10 researcher list on BugCrowd 6/2016Placed 2nd at CactusCon 2016 RootTheBox CTF 5/2016Ranked 19th on BugCrowd's Worldwide Leaderboard Bug Bounty 5/2016Charts 4 PHP 1.2.3 Cross Site Scripting (Full Disclosure) () 2/2016Open Web Analytics 1.5.7 Cross Site Scripting (Full Disclosure) () 2/2016WordPress All In One SEO Pack 2.2.2 Cross Site Scripting (Full Disclosure) 2/2016PS: Directory Tra In NETGEAR R7800 Routers 0day () 1/2016PS: Cleartext Submission of Password In NETGEAR R7800 Routers 0day () 1/2016PS: Denial of Service (DoS) in NETGEAR R7800 Routers 0day 1/2016PS: Unrestricted Arbitrary File Upload In NETGEAR R7800 Routers 0day () 1/2016PS: Directory Tra In NETGEAR R7800 Routers 0day () 1/2016PS: Denial of Service (DoS) in NETGEAR R7800 Routers 0day 1/2016PS: Server Side Request Forgery in NETGEAR R7800 Routers 0day () 1/20162015:
Made the top 10 researcher list on BugCrowd 11/2015Wordpress XMLRPC System Multicall Brute Force Exploit (0day) Exploit/PoC 10/2015Aruba AP-205 Remote Command Injection ($750 bounty) () 10/2015Apache Range Header Denial of Service Exploit (C) Exploit/PoC 8/2015Listed on AT&T's Bug Bounty Hall of Fame Bug Bounty () 8/2015Won the InfoSec Institute Practical Web CTF #2 Challenge () 8/2015HP Photosmart 7520 Printers Stored Cross Site Scripting (0day) Exploit/CVE 7/2015Supermicro IPMI/BMC Cleartext Password Scanner Exploit/PoC 3/2015WebFOCUS 533 Server XSS & Directory Tra (0day) Exploit/CVE 2/2015Imgur Server Side Request Forgery (SSRF) ($1600 bounty) () 1/2015C GHOST glibc gethostbyname buffer o Exploit () 1/2015Hak5 Wifi Pinnapple Code Execution Exploit/CVE 1/2015Hak5 Wifi Pinnapple Cross Site Scripting Exploit/CVE 1/20152014:
Lyris ListManagerWeb 8.95a Cross Site Scripting (Full Disclosure) () 7/2014MyConnection Server (MCS) 9.7i Cross Site Scripting (Full Disclosure) () 7/2014AlogoSec FireFlow 6.3 Cross Site Scripting (Full Disclosure) () 7/2014Recie Security Certified Professional (OSCP) certification 2/2014项目信息
开发语言：Python
Star 数：209
技术要点
该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Exploits by 1N3 @CrowdShield @xer0dayz @XeroSecurity展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。