Exploit for CVE-2021-31805 (RCE in Apache Struts 2)
Copy link to “Exploit for CVE-2021-31805 (RCE in Apache Struts 2)”Sniper can now exploit an RCE vulnerability in Apache Struts 2 (CVE-2021-31805).
Changelog
These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
Date
April 2022
Exploit for CVE-2022-0543 (RCE in Redis)
Copy link to “Exploit for CVE-2022-0543 (RCE in Redis)”Sniper can now exploit an RCE vulnerability in Redis (CVE-2022-0543).
Exploit for CVE-2022-22954 (RCE in VMware Workspace)
Copy link to “Exploit for CVE-2022-22954 (RCE in VMware Workspace)”Sniper can now exploit an RCE vulnerability in the VMware Workspace ONE Access (CVE-2022-22954).
Exploit for CVE-2022-24086 (RCE in Magento)
Copy link to “Exploit for CVE-2022-24086 (RCE in Magento)”Sniper can now exploit an unauthenticated RCE vulnerability in Magento (CVE-2022-24086).
Exploit for CVE-2022-22963 (RCE in Spring Cloud)
Copy link to “Exploit for CVE-2022-22963 (RCE in Spring Cloud)”Sniper can now exploit an RCE vulnerability in Spring Cloud Function - a library in Spring (CVE-2022-22963).
Exploit for CVE-2022-22965 (Spring4Shell - RCE in Spring Core)
Copy link to “Exploit for CVE-2022-22965 (Spring4Shell - RCE in Spring Core)”Sniper can now exploit an RCE vulnerability in Spring core - a main component of the Java Spring Framework (CVE-2022-22965 - Spring4Shell).
'Unconfirmed' tag for Website Scanner findings
Copy link to “'Unconfirmed' tag for Website Scanner findings”Website Scanner findings that haven't been automatically validated by our scanner and need further manual verification will be marked with the 'Unconfirmed' tag.
Added API support for Domain Finder
Copy link to “Added API support for Domain Finder”The Domain Finder tool can now be accessed via the API.
March 2022
Authenticated Sniper scans
Copy link to “Authenticated Sniper scans”Sniper can now authenticate to the target service using the provided credentials. Then it will extract the artefacts as an authenticated user.
Exploit for CVE-2022-22947 (RCE in Spring Cloud Gateway)
Copy link to “Exploit for CVE-2022-22947 (RCE in Spring Cloud Gateway)”Sniper can now exploit an RCE vulnerability in Spring Cloud Gateway (CVE-2022-22947).
New parameter in Domain Finder - Minimum Weight
Copy link to “New parameter in Domain Finder - Minimum Weight”The Domain Finder assigns a certain weight (or certainty) to each result to validate its correctness. Now the value of this parameter can be set to better filter the results.
Exploit for CVE-2017-12611 (RCE in Apache Struts)
Copy link to “Exploit for CVE-2017-12611 (RCE in Apache Struts)”Sniper can now exploit an RCE in the Apache Struts Framework (CVE-2017-12611).
February 2022
Detection for CVE-2020-14882/14883 (Authentication Bypass in Oracle Weblogic)
Copy link to “Detection for CVE-2020-14882/14883 (Authentication Bypass in Oracle Weblogic)”The Network Scanner can now detect if an Oracle Weblogic Server is vulnerable to an Authentication Bypass vulnerability (CVE-2020-14882, CVE-2020-14883).
Domain Finder in Robots
Copy link to “Domain Finder in Robots”Added the possibility to chain the Domain Finder tool within the Pentest Robots.
Exploit for CVE-2021-44228 (Log4shell - RCE in Apache Struts 2)
Copy link to “Exploit for CVE-2021-44228 (Log4shell - RCE in Apache Struts 2)”Sniper can now exploit an RCE in the Log4j logging library from Apache Struts 2 (CVE-2021-44228).
Exploit for CVE-2021-44515 (RCE in Zoho ManageEngine)
Copy link to “Exploit for CVE-2021-44515 (RCE in Zoho ManageEngine)”Sniper can now exploit an Authentication Bypass and RCE vulnerability in Zoho ManageEngine Desktop Central (CVE-2021-44515).
Exploit for CVE-2021-45046 (Log4shell - RCE in Log4j)
Copy link to “Exploit for CVE-2021-45046 (Log4shell - RCE in Log4j)”Sniper can now exploit an RCE in the Log4j logging library (CVE-2021-45046).
Exploit for CVE-2022-23131 (Authentication Bypass and Remote Code Execution in Zabbix)
Copy link to “Exploit for CVE-2022-23131 (Authentication Bypass and Remote Code Execution in Zabbix)”Sniper can now exploit an Authentication Bypass leading to Remote Code Execution in Zabbix (CVE-2022-23131).
Wordlists in Subdomain Finder
Copy link to “Wordlists in Subdomain Finder”Choose your own wordlist or pick from the default ones in order to uncover new subdomains by trying each of them in the DNS Enumeration method of the Subdomain Finder.
Detection for CVE-2017-0144 (EternalBlue - RCE in Microsoft Windows)
Copy link to “Detection for CVE-2017-0144 (EternalBlue - RCE in Microsoft Windows)”The Network Scanner can now detect if a Microsoft Windows instance is vulnerable to EternalBlue (CVE-2017-0144).