Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2024-55591-poc — Educational implementation in Go for CVE-2024-55591 (Fortinet FortiOS Authentication Bypass). Designed for security research, vulnerability assessment, and understanding WebSocket-based auth bypass mechanisms. | Kitploit
Tools/GitHubGitHub/ull0a/cve-2024-55591-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingAuthentication
GitHubull0a/cve-2024-55591-poc

cve-2024-55591-poc

Educational implementation in Go for CVE-2024-55591 (Fortinet FortiOS Authentication Bypass). Designed for security research, vulnerability assessment, and understanding WebSocket-based auth bypass mechanisms.

View Repository
110h 56m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-55591 - Fortinet FortiOS Authentication Bypass

An educational implementation in Go demonstrating the technical mechanics of CVE-2024-55591, an authentication bypass vulnerability affecting Fortinet FortiOS. This repository is intended strictly for security research, defensive analysis, and authorized penetration testing.

How It Works

This tool is structured around two main phases (Target Validation and Exploitation) that mirror the vulnerability workflow:

Phase 1: Target Validation & Detection

  1. Management Interface Probing: Sends an HTTP/HTTPS GET request to /login?redir=/ng and inspects the response body for FortiOS signatures (FortiOS, FortiGate, class="main-app", etc.).
  2. Vulnerability Check: Queries /service-worker.js?local_access_token=<token> to verify whether the target endpoint exposes internal application routing (), confirming vulnerability status.
api/v2/static

Phase 2: Exploitation & Command Execution

  1. WebSocket Upgrade: Connects to the target CLI management WebSocket endpoint (/ws/cli/open) using a custom HTTP upgrade request, supplying the required local access token and handling WebSocket handshake framing.
  2. Authentication Bypass: Injects crafted authentication frames containing administrative user contexts and tokens over the established WebSocket channel. Repeatedly polls the channel until a valid response confirms successful session establishment.
  3. Command Execution: Sends formatted CLI payloads through the authenticated WebSocket connection and streams real-time standard output back to the terminal.

Features

  • Robust Protocol Handling: Supports both HTTP and HTTPS with automatic fallback options.
  • Flexible TLS Configuration: Allows custom TLS version selection (auto, 1.0, 1.1, 1.2, 1.3) with insecure certificate verification for testing environments.
  • WebSocket Frame Crafting: Implements manual WebSocket frame generation (with masking keys and payload length calculations) without relying on external third-party Gorilla WebSocket packages.
  • Configurable Parameters: Supports custom timeouts, retry limits, and verbosity flags.
  • WatchTowr. (2024). Get FortiRekt: I am the super_admin now - FortiOS Authentication Bypass (CVE-2024-55591). watchTowr Labs. https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/
Download Tool