small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns
☆335Apr 8, 2024Updated 2 years ago
Alternatives and similar repositories for lfi-labs
Users that are interested in lfi-labs are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- packetstormsecurity.net exploit archive 133ch3r☆25Feb 22, 2011Updated 15 years ago
- Working Rsh Client With Bind/Reverse Shell☆19Sep 15, 2015Updated 11 years ago
- MoneyX is an intentionally vulnerable JSP application used for training developers in application security concepts.☆30May 10, 2016Updated 10 years ago
- SQLI labs to test error based, Blind boolean based, Time based.☆5,869Dec 11, 2023Updated 2 years ago
- a CMD shell in masm that listens on port 8080☆12Dec 19, 2020Updated 5 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Damn Vulnerable File Upload V 1.1☆105May 26, 2018Updated 8 years ago
- Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn rea…☆461Dec 6, 2021Updated 4 years ago
- A C# web handler that is vulnerable to XXE with PoC. This is to serve as an example of what vulnerable C# code looks like.☆26Aug 10, 2013Updated 13 years ago
- Local UNIX PrivEsc Aggregation☆242Apr 9, 2016Updated 10 years ago
- Capture passwords of login attempts on non-existent and disabled accounts.☆38Aug 17, 2022Updated 4 years ago
- Spray SMB with hashes, Then psexec☆32Jul 3, 2019Updated 7 years ago
- Use HTTP Smuggling Lab to learn HTTP Smuggling.☆348Nov 20, 2022Updated 3 years ago
- Automatically exported from code.google.com/p/unix-security-file-parser☆34Dec 21, 2015Updated 10 years ago
- Pivoter is a proxy tool for pentesters to have easier lateral movement.☆144Aug 9, 2015Updated 11 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- psychoPATH - an advanced path traversal tool. Features: evasive techniques, dynamic web root list generation, output encoding, site map-s…☆276Feb 12, 2021Updated 5 years ago
- small set of scripts to practice exploit XSS and CSRF vulnerabilities☆67Dec 22, 2017Updated 8 years ago
- 一个想帮你总结所有类型的上传漏洞的靶场☆4,200Jun 26, 2023Updated 3 years ago
- This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack☆800Aug 21, 2023Updated 3 years ago
- 一个包含php,java,python,C#等各种语言版本的XXE漏洞Demo☆817Nov 28, 2022Updated 3 years ago
- Recon, Subdomain Bruting, Zone Transfers☆227Aug 2, 2016Updated 10 years ago
- Basic app to practice modsec bypass☆23May 12, 2016Updated 10 years ago
- A simple web app with a XXE vulnerability.☆230Nov 10, 2021Updated 4 years ago
- Check privileges, settings and other information on Linux systems and suggest exploits based on kernel versions☆25Jul 18, 2017Updated 9 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Pentesters spend too much time during information gathering phase. Flashlight (Fener) provides services to scan network/ports and gather …☆195Jun 23, 2019Updated 7 years ago
- This is a SOAP service written in C# that has intentional SQL injection vulnerabilties.☆21Nov 27, 2016Updated 9 years ago
- This tool generates gopher link for exploiting SSRF and gaining RCE in various servers☆3,428Apr 18, 2023Updated 3 years ago
- A simple tool to dump users in popular forums and CMS :)☆31Jan 30, 2018Updated 8 years ago
- Provide a sort of shell-ish interface to make file directory traversal quicker and easier.☆25Jan 1, 2017Updated 9 years ago
- rev-door is a small backdoor with only ONE line of PHP code, which takes command from POST data and execute it on server side. It is like…☆26May 12, 2016Updated 10 years ago
- 🔥 Hacker Scripts for CTF Challenges.☆25Jul 12, 2019Updated 7 years ago
- Git All the Payloads! A collection of web attack payloads.☆4,003May 15, 2023Updated 3 years ago
- A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and…☆3,995Sep 27, 2021Updated 5 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- PwnableWeb is a suite of web applications for use in information security training.☆87Jun 7, 2014Updated 12 years ago
- Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.☆1,812Dec 1, 2024Updated last year
- Server-Side Template Injection and Code Injection Detection and Exploitation Tool☆4,215Apr 21, 2024Updated 2 years ago
- The cheat sheet about Java Deserialization vulnerabilities☆3,188May 26, 2023Updated 3 years ago
- OWSAP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication.☆364Jul 24, 2026Updated 3 months ago
- An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability☆467Aug 7, 2026Updated 2 months ago
- POC-T强化版本 POC-S , 用于红蓝对抗中快速验证Web应用漏洞， 对功能进行强化以及脚本进行分类添加，自带dnslog等, 平台补充来自vulhub靶机及其他开源项目的高可用POC☆355Mar 12, 2020Updated 6 years ago