Ethical hacking & pentesting blog
Come for the PoCs and security research focused on new CVEs and stay for the ethical exploitation guides and how-tos our offensive security specialists create.
Get fresh security research
In your inbox. (No fluff. Actionable stuff only.)
How to exploit the VMware vCenter RCE with Pentest-Tools.com (CVE-2021-21985)
More high-risk vulnerabilities mean more work for you. The good news? You won’t be out of work anytime soon. The bad news? You’ll probably work a lot more than you anticipate. So how do you balance the good and the not-so-great? By having a replicable process for when a high-risk CVE that leads to RCE hits your targets (the likes of CVE-2021-21985).
- Author(s)
- Published at
- Updated at
December updates: 6 new ways to make your workflow smoother
Hope 2022 is off to a great start for you! Supporting your security efforts is what we do, so here’s a fresh batch of platform updates we rolled out at the end of 2021. Why check them out? Because they’ll help you get more work done, faster with the same tools and features you know (and hopefully love!).
- Author(s)
- Published at
- Updated at
How we detect and exploit Log4Shell to help you find targets using vulnerable Log4j versions
We’re breaking down our technique for detecting CVE-2021-44228 (Log4Shell) because we believe our users should understand what’s happening behind the scanners so they can avoid a false sense of security.
- Author(s)
- Published at
- Updated at
November updates for powerful workflows, including detection for Log4Shell
Giving you the tools you need right now to speed up detection and reporting is always our top priority. Especially when your work is essential to effectively prioritize remediation. So, with every monthly update, we strive to do just that.
- Author(s)
- Published at
- Updated at
How to detect the Zoho ManageEngine ADSelfService Plus RCE (CVE-2021-40539)
Overwhelmed by so many high-risk vulnerabilities that emerge? Thousands of them are disclosed every year and 2021 is no exception. Systems are complex, cyber attacks get more sophisticated, and patching is still a challenge for many organizations. As infosec pros, it’s our responsibility to help companies (and individuals) understand the real implications and impact of a critical vulnerability and help them find it before it gets worse.
- Author(s)
- Published at
- Updated at
Detect and exploit Gitlab CE/EE RCE with Pentest-Tools.com (CVE-2021-22205)
“Just patch it!” is the usual advice when a vulnerability hits (and it’s not a zero-day). But it’s never that simple in organizations that have to manage layers upon layers of infrastructure. When you have to deal with a critical CVE like the latest unauthenticated RCE in Gitlab (CVSSv3 10.0), the tangled, messy process of patching bubbles to the surface.
- Author(s)
- Published at
- Updated at
How to detect CVE-2021-22986 RCE with Pentest-Tools.com
As a pentester, when you see a major critical vulnerability persist for months in unpatched systems (like Log4Shell), you have a responsibility to help others understand its severity and how they can fix it. This is exactly why this article exists.
- Author(s)
- Published at
- Updated at
