Confluence OGNL injection

Last update: Sep 23, 2022

Overview

CVE-2021-26084

Confluence OGNL injection

CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in the Atlassian Confluence Webwork implementation. An unauthenticated, remote attacker could exploit this flaw by sending a specially crafted request to vulnerable endpoints on the Confluence Server or Data Center instance. Successful exploitation would allow an attacker to execute arbitrary code.

Note - make sure to change the collaborator id.

Usage

python3 CVE-2021-26084.py http://target

Authors

• D0rkerDevil

This is for educational purposes, Authors are not responsible for any damages.

Owner

Ashish Kunwar

Researcher at RISKIQ | I deal with 0days and malwares

GitHub Repository

Steal Files on a Windows Machine

File-Stealer Steal Files on a Windows Machine About This Script will steal certain Files on a Windows Machine and sends them to a FTP Server. Preview

5 Nov 17, 2022

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples Above is an adversarial example: the slightly pert

838 Dec 18, 2022

Add a Web Server based on Rogue Mysql Server to allow remote user get

介绍对于需要使用 Rogue Mysql Server 的漏洞来说，若想批量检测这种漏洞的话需要自备一个服务器。并且我常用的Rogue Mysql Server 脚本不支持动态更改读取文件名、不支持远程用户访问读取结果、不支持批量化检测网站。于是乎萌生了这个小脚本的想法 Rogue-MySql-

6 May 17, 2022

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP top 10 https://owasp.org/www-project-top-ten/# as well as run a

1 Nov 12, 2021

POC using subprocess lib in Python 🐍

POC subprocess ☞ POC using the subprocess library with Python. References: https://github.com/GuillaumeFalourd/poc-subprocess https://geekflare.com/le

2 Nov 28, 2022

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Microsoft_Exchange_Server_SSRF_CVE-2021-26855 zoomeye dork：app:"Microsoft Exchange Server" 使用Seebug工具箱及pocsuite3编写的脚本Microsoft_Exchange_Server_SSRF_CV

37 Nov 12, 2022

Natural Language Processing - Sommer Semester 2022

Natural Language Processing (DIS25a/NLP) This course can be taken for the Bachelor Programm Data and Information Science (DIS25a) or the Master Progra

19 Sep 07, 2022

SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities.

The SCodeScanner stands for Source Code Scanner, where you can scan your source code files like PHP and get identify the vulnerabilities inside it. The tool can use by Pentester, Developer to quickly

136 Dec 13, 2022

This a simple tool XSS Detection Suite for CTFs games

2 Nov 24, 2021

This is a simple PoC for the newly found Polkit error names PwnKit

A Python3 and a BASH PoC for CVE-2021-4034 by Kim Schulz

16 Sep 06, 2022

DepFine Is a tool to find the unregistered dependency based on dependency confusion valunerablility and lead to RCE

DepFine DepFine Is a tool to find the unregistered dependency based on dependency confusion valunerablility and lead to RCE Installation: You Can inst

14 Nov 11, 2022

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities Which is a great tool for web pentesters. Coded in python3, CLI. WebScan is capable of scanni

12 Dec 02, 2022

Python decompiler for Python 1.5-2.4 (for historical archive)

This preserves the early code of a Python decompiler for Python versions 1.5 to 2.4. I have been able to install this using pyenv using Python 2.3.7 u

2 Jan 04, 2022

Tools to make working the Arch Linux Security Tracker easier

This is a collection of Python scripts to make working with the Arch Linux Security Tracker easier.

6 Jul 13, 2022

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

MongoDB-Injection Cheesy Multi-threaded script for NoSQL Injection This challeng

2 Jun 06, 2022

Confluence OGNL injection

Related tags

Overview

CVE-2021-26084

Note - make sure to change the collaborator id.

Usage

Authors

Owner

Ashish Kunwar

Steal Files on a Windows Machine

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

Add a Web Server based on Rogue Mysql Server to allow remote user get

Kriecher is a simple Web Scanner which will run it's own checks for the OWASP

POC using subprocess lib in Python 🐍

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Natural Language Processing - Sommer Semester 2022

SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities.

This a simple tool XSS Detection Suite for CTFs games

This is a simple PoC for the newly found Polkit error names PwnKit

DepFine Is a tool to find the unregistered dependency based on dependency confusion valunerablility and lead to RCE

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities

Python decompiler for Python 1.5-2.4 (for historical archive)

Tools to make working the Arch Linux Security Tracker easier

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

Advanced subdomain scanner, any domain hidden subdomains

Rouge Spammers with a mission to disrupt the peace of the valley ? Fear not we will STOMP the Spammers

An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Vuln Scanner With Python

POC for CVE-2022-1388