CVE-2021-26855 SSRF Exchange Server

Last update: Nov 28, 2022

Overview

CVE-2021-26855 Brute Force EMail Exchange Server

Timeline:

Monday, March 8, 2021: Update Dumping content...(I'm not done, can u guy help me done this code ;-;)

Tuesday, March 9, 2021: Remake to simple check valid mail

Wednesday, March 10, 2021: Maybe im done this script, now im waiting true cve pre-auth rce

Sometime, some server extract domain tld is wrong

Download users.txt list from github or u find it with Google Dork: intext:'@domain.ltd'

Shodan

https://beta.shodan.io/search?query=http.component%3A%22outlook+web+app%22
https://beta.shodan.io/search?query=http.html%3A%22%2Fowa%22

Fofa

https://fofa.so/result?q=title%3D%22Outlook+Web+App%22
https://fofa.so/result?q=%22%2Fowa%22&qbase64=Ii9vd2Ei
https://gist.githubusercontent.com/pikpikcu/fb604e01a7555adb1577a2fbc856022d/raw/ef3025f809c6ca87d22f01914b230d35f39c0ac2/fofa%2520dork-CVE-2021-26855.md

Zoomeye

https://www.zoomeye.org/searchResult?q=%2Fowa

Owner

lulz

retarded kid trying to use internet

GitHub Repository

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

2.8k Dec 29, 2022

SSL / TLS Checking Tool written in Python3

ssts-chk SSL / TLS Checking Tool written in Python3. This tool will perform the following functions: Connect the target given Analyze the secure conne

2 Feb 12, 2022

Safety checks your installed dependencies for known security vulnerabilities

Safety checks your installed dependencies for known security vulnerabilities. By default it uses the open Python vulnerability database Safety DB, but

1.4k Dec 30, 2022

An automated header extensive scanner for detecting log4j RCE CVE-2021-44228

log4j An automated header extensive scanner for detecting log4j RCE CVE-2021-44228 Usage $ python3 log4j.py -l urls.txt --dns-log REPLACE_THIS.dnslog.

2 Dec 16, 2021

version de mi tool de kali linux para miertuxzzzz digo, termux >:)

Msf-Tool 1.0 Termux apt install git -y apt install python apt install python3 apt install python3-pip apt install metasploit ---- ---- git clone ht

1 Feb 20, 2022

Web-eyes - OSINT tools for website research

WEB-EYES V1.0 web-eyes: OSINT tools for website research, 14 research methods ar

8 Nov 10, 2022

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

Flask-SeaSurf SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF). CSRF vulnerabilities have been found in large and popular

183 Dec 28, 2022

DNS hijacking via dead records automation tool

DeadDNS Multi-threaded DNS hijacking via dead records automation tool How it works 1) Dig provided subdomains file for dead DNS records. 2) Dig the fo

45 Dec 20, 2022

Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source

Infoga - Email OSINT Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source (search engines, pg

1.8k Jan 04, 2023

BloodyAD is an Active Directory Privilege Escalation Framework

BloodyAD Framework BloodyAD is an Active Directory Privilege Escalation Framework, it can be used manually using bloodyAD.py or automatically by combi

757 Jan 07, 2023

LittleBrother is a simple parental control application monitoring specific processes on Linux hosts to monitor and limit the play time of children.

Parental Control Application LittleBrother Overview LittleBrother is a simple parental control application monitoring specific processes (read "games"

40 Dec 21, 2022

CVE-2021-26855 SSRF Exchange Server

Related tags

Overview

CVE-2021-26855 Brute Force EMail Exchange Server

Timeline:

Shodan

Fofa

Zoomeye

Owner

lulz

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

SSL / TLS Checking Tool written in Python3

Safety checks your installed dependencies for known security vulnerabilities

An automated header extensive scanner for detecting log4j RCE CVE-2021-44228

version de mi tool de kali linux para miertuxzzzz digo, termux >:)

Web-eyes - OSINT tools for website research

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

DNS hijacking via dead records automation tool

Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source

BloodyAD is an Active Directory Privilege Escalation Framework

LittleBrother is a simple parental control application monitoring specific processes on Linux hosts to monitor and limit the play time of children.

Facebook Fast Cracking Tool With Python

Uncover the full name of a target on Linkedin.

Bilgi Sistemleri Projesi için yapılan keylogger

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

Acc-Data-Gen - Allows you to generate a password, e-mail & token for your Minecraft Account

High level cheatsheet that was designed to make checks on the OSCP more manageable

将hw时信息收集以及简单的漏洞操作步骤简单化

A proxy server application written in python for trial purposes