Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-49132-PoC — Proof-of-concept exploit for CVE-2025-49132, a path traversal vulnerability in Pterodactyl panel. Forges session cookies using exposed Redis server to access the API. | Kitploit
Tools/GitHubGitHub/typicalsmc/cve-2025-49132-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubtypicalsmc/cve-2025-49132-poc

CVE-2025-49132-PoC

Proof-of-concept exploit for CVE-2025-49132, a path traversal vulnerability in Pterodactyl panel. Forges session cookies using exposed Redis server to access the API.

View Repository
5 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Guide to use script that exploit the Pterodactyl Path Traversal at locale.json

Requirements

  • Exposed Redis Server
  • Panel URL

Guide

  1. Get access to the server configuration file, which has APP_KEY and Redis Database Password + IP
  2. Use forge_cookie to generate a pterodactyl_session cookie
  3. Use that cookie to access Pterodactyl API

Note

  • This script is for educational purposes only. Use it responsibly and ensure you have permission to test the target system.
  • Logging in through the panel webpanel can not be done due to requirement of "remember_token" which is stored in the SQL Database.
  • Only accessing the API is possible with the forged cookie.
Download Tool