😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Last update: Oct 14, 2022

Overview

😭 WSOB (CVE-2022-29464)

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

CVE-2022-29464 details:

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

Source: https://nvd.nist.gov/vuln/detail/CVE-2022-29464

⚡ Installing / Getting started

A quick guide of how to install and use WSOB.

1. Clone the repository - git clone https://github.com/oppsec/wsob.git
2. Install the libraries - pip3 install -r requirements.txt
3. Run WSOB2 - python3 main.py -u https://example.com

⚙️ Pre-requisites

Python 3 installed on your machine.
Install the libraries with pip3 install -r requirements.txt

🔨 Contributing

A quick guide of how to contribute with the project.

1. Create a fork from WSOB repository
2. Download the project with git clone https://github.com/your/wsob.git
3. Make your changes
4. Commit and make a git push
5. Open a pull request

🙏 Credits

Credits to hakivvi for the original exploit

⚠️ Warning

The developer is not responsible for any malicious use of this tool.

You might also like...

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

About create a target list or select one target, scans then exploits, done! Vulnnr is a Vulnerability Scanner & Auto Exploiter You can use this tool t

108 Dec 4, 2021

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

Releases(0.2)

0.2(Jul 6, 2022)
0.2 - 2022-07-24

Improved the code

Fixed not verifying the status code to determine if target is vulnerable

Changed application banner

New banner image on README

Added description to exploit function

Updated application UI

Full Changelog: https://github.com/oppsec/WSOB/commits/0.2
Source code(tar.gz)
Source code(zip)

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Related tags

Overview

😭 WSOB (CVE-2022-29464)

CVE-2022-29464 details:

⚡ Installing / Getting started

⚙️ Pre-requisites

🔨 Contributing

🙏 Credits

⚠️ Warning

You might also like...

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

This repository detects a system vulnerable to CVE-2022-21907 and protects against this vulnerability if desired

CVE-2022-21907 Vulnerability PoC

CVE-2022-23046 - SQL Injection Vulnerability on PhpIPAM v1.4.4

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

Exploit and Check Script for CVE 2022-1388

Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit

Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability

Releases(0.2)

0.2(Jul 6, 2022)

0.2 - 2022-07-24

Owner

0p

Wireguard VPN Server Installer for: on Ubuntu, Debian, Arch, Fedora and CentOS

A great and handy python obfuscator for protecting code.

This repo created for bypassing Widevine L3 DRM and obtaining keys.

Fuck - Multi Brute Force 🚶‍♂

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

AttractionFinder - 2022 State Qualified FBLA Attraction Finder Application

Installation of hacking tools

A curated list of amazingly awesome Cybersecurity datasets

Tools ini digunakan untuk krekk pacebuk:v

This is the fuzzer I made to fuzz Preview on macOS and iOS like 8years back when I just started fuzzing things.

macOS Initial Access Payload Generator

JumpServer远程代码执行漏洞检测利用脚本

(D)arth (S)ide of the (L)og4j (F)orce, the ultimate log4j vulnerabilities assessor

A decompilation of the Nintendo Switch version of Captain Toad: Treasure Tracker

LdapRelayScan - Check for LDAP protections regarding the relay of NTLM authentication

Spray365 is a password spraying tool that identifies valid credentials for Microsoft accounts (Office 365 / Azure AD).

Learning to compose soft prompts for compositional zero-shot learning.

Spring-0day/CVE-2022-22965

This tool ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes.

Hikvision 流媒体管理服务器敏感信息泄漏