Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/mikecostanzi/ricerca-tesi
Vulnerability AnalysisExploitationInformation GatheringPapers & ResearchCurated Resources
GitHubmikecostanzi/ricerca-tesi

ricerca-tesi

risorse di ricerca per cve-2026-7228

View Repository
220 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

thesis-research

research resources for cve-2026-7228

Tools

VirtualBox installation

VirtualBox installation: https://www.virtualbox.org/wiki/Downloads

Windows 11 ISO installation

https://www.microsoft.com/it-it/software-download/windows11

Linux distro installation: lubuntu

https://lubuntu.me/downloads/

Pizzafy E-Commerce source code site

https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html

XAMPP installation

  1. XAMPP installation
  2. mysql and apache: start
  3. use phpmyadmin ( http://localhost/phpmyadmin ) to create the pizzafy database and import the pizzafy.sql file from the source code to the local database.
Download Tool

Burp Suite installation ( or Postman )

Test

Reference links

cve vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2026-7228

github for exploits and solutions: https://github.com/fernando-mengali/vulndb-submissions.git

Site on the server

Extract the pizzafy project and move the folder into apache's htdocs on xampp

Test URL

pizzafy site: http://localhost/pizzafy/Pizzafy/

admin login: http://localhost/pizzafy/Pizzafy/admin/login.php

Credentials → Username: [email protected] Password: admin123

SQL injection

Specifically Error-Based SQL Injection returning the error in XML

Testing URL

First with GET method : http://localhost/Pizzafy/pizzafy/view_prod.php?id=

Test payload

root@kitploit:~

9%20AND%20extractvalue(rand(),%20concat(0x7e,version()))%20--

Output:

payload-version

Exploit Test

Programming language: ==python==

Library used: request import request

Exploit file: /script/test.py

Running the exploit file

Running test.py

Output:

output-exploit-test

john the ripper

Installing john the ripper to decrypt passwords from the hash value. For operating systems like Kali the tool is already installed.

Save the password(s) in a txt file: hash.txt

Installing the rockyou.txt file: git clone https://gitlab.com/kalilinux/packages/wordlists.git gunzip rockyou.txt.gz

Type of encrypted password: ==bcrypt==

Running the tool with the wordlist file: john --wordlist=rockyou.txt --format=bcrypt hash.txt

Output:

password-cracked

Password: admin123

Environment preparation

  1. Open virtual-box and set an ip address through host-only for the windows 11 virtual machine

    • Go to Settings -> Network -> Adapter 1 -> Set Host-only Adapter and then type the name where the ip address is present
    • Type Adapter 2 -> set NAT

    set-host-only

    set-nat

  2. Start the Windows 11 machine and check if the ip address was set correctly

    Type: ipconfig

    controllo-ip

  3. Start Apache and MySQL start-server-mysql-xampp

Attack

  1. Start the kali virtual machine or any other linux distro
  2. Create a python interpreter environment
  3. Run the exploit.py file specifying the ip address of the machine being attacked in the URL
root@kitploit:~
	python3 exploit.py

Code

Vulnerable code

Open pizzafy/Pizzafy and find the view_prod.php file and find the following part: codice-vulnerabile

Fixed code 1

codice-fix-1

Fixed code 2

codice-fix-2