mr-xn/penetration_testing_pocPOC, EXP, script, privilege escalation, piccoli strumenti relativi a test di penetrazione, ecc.---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms
## <span id="head1"> Penetration_Testing_POC</span> Raccolta di condivisioni di posture, POC, script, strumenti, articoli, ecc. utilizzati nei penetration test, come appunti; contributi benvenuti. **Si prega di verificare che tutti gli strumenti non contengano backdoor o altri comportamenti anomali; si raccomanda di operare sempre in un ambiente virtuale.** - [Penetration_Testing_POC](#head1) - [Si prega di utilizzare la ricerca [`Ctrl+F`] per trovare](#head2) - [Dispositivi IOT e telefoni cellulari](#head3) - [Applicazioni Web](#head4) - [Supporto per l'escalation dei privilegi](#head5) - [PC](#head6) - [tools - raccolta di piccoli strumenti](#head7) - [Articoli/libri/tutorial](#head8) - [Note](#head9) ## <span id="head2"> Si prega di utilizzare la ricerca [`Ctrl+F`] per trovare</span> ## <span id="head3">Dispositivi IOT e telefoni cellulari</span> - [Il router awifi di Tianyi Skyworth presenta molteplici vulnerabilità di accesso non autorizzato](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%A9%E7%BF%BC%E5%88%9B%E7%BB%B4awifi%E8%B7%AF%E7%94%B1%E5%99%A8%E5%AD%98%E5%9C%A8%E5%A4%9A%E5%A4%84%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md) - [Vulnerabilità CSRF nella pagina di gestione del prodotto Huawei WS331a](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAWS331a%E4%BA%A7%E5%93%81%E7%AE%A1%E7%90%86%E9%A1%B5%E9%9D%A2%E5%AD%98%E5%9C%A8CSRF%E6%BC%8F%E6%B4%9E.md) - [CVE-2019-16313 Vulnerabilità di divulgazione della password nel router enterprise Fengwang Hulian v4.31](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16313%20%E8%9C%82%E7%BD%91%E4%BA%92%E8%81%94%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A8v4.31%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md) - [Vulnerabilità RCE del router D-Link](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16920-D-Link-rce.md) - [CVE-2019-13051 - Iniezione di comandi e escalation di privilegi nel software di blocco annunci lato router Pi-Hole](https://github.com/mr-xn/penetration_testing_poc/blob/master/vuln_pocs/cve/CVE-2019-13051) - [D-Link DIR-859 - RCE UnAutenticated (CVE-2019–17621)](https://github.com/s1kr10s/D-Link-DIR-859-RCE) - [Huawei HG255 Directory Traversal[directory traversal]](https://packetstormsecurity.com/files/155954/huaweihg255-traversal.rb.txt)|[file di backup locale](https://github.com/mr-xn/penetration_testing_poc/blob/master/tools/huaweihg255-traversal.rb) - [D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)CVE-2019-20215(Metasploit)](https://github.com/mr-xn/penetration_testing_poc/blob/master/POC_Details/D-Link%20Devices%20-%20Unauthenticated%20Remote%20Command%20Execution%20in%20ssdpcgi%20%28Metasploit)%20CVE-2019-20215.rb) - [Da Interfaces.d a RCE: scoperta di vulnerabilità nel gateway IoT Mozilla WebThings](https://research.nccgroup.com/2020/02/10/interfaces-d-to-rce/) - [Vulnerabilità di esecuzione remota di comandi nei router della serie Xiaomi (CVE-2019-18370, CVE-2019-18371)](https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/report/report.md) - [Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload - sostituzione del firmware senza autenticazione)](https://www.exploit-db.com/exploits/48158) - [cve-2020-8634&cve-2020-8635](https://www.exploit-db.com/exploits/48160)|[Scoperta, analisi e riproduzione della vulnerabilità di escalation di privilegi in Wing FTP Server 6.2.3](https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php)|[Escalation di privilegi in Wing FTP Server 6.2.5](https://www.exploit-db.com/exploits/48154) - [CVE-2020-9374-TP LINK TL-WR849N - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2020-9374.md) - [CVE-2020-12753 - Vulnerabilità di esecuzione di codice arbitrario negli smartphone LG](https://github.com/shinyquagsire23/CVE-2020-12753-PoC) - [CVE-2020-12695 - Vulnerabilità di sicurezza UPnP](https://github.com/yunuscadirci/CallStranger) - [79 router Netgear compromessi da remoto tramite 0day](https://github.com/grimm-co/NotQuite0DayFriday/blob/master/2020.06.15-netgear/exploit.py) - [dlink-dir610-exploits-Exploits for CVE-2020-9376 and CVE-2020-9377](https://github.com/renatoalencar/dlink-dir610-exploits) - [wacker: una raccolta di script che facilitano attacchi di dizionario online contro punti di accesso WPA3](https://github.com/blunderbuss-wctf/wacker) - [CVE-2020-24581 Analisi della vulnerabilità di esecuzione remota di comandi in D-Link DSL-2888A](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/CVE-2020-24581%20D-Link%20DSL-2888A%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.pdf)-[indirizzo originale](https://www.anquanke.com/post/id/229323) - [CNVD-2021-14536_Vulnerabilità di divulgazione delle credenziali di account e password nel sistema di audit per la gestione unificata del comportamento di navigazione Ruijie RG-UAC](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CNVD-2021-14536_%E9%94%90%E6%8D%B7RG-UAC%E7%BB%9F%E4%B8%80%E4%B8%8A%E7%BD%91%E8%A1%8C%E4%B8%BA%E7%AE%A1%E7%90%86%E5%AE%A1%E8%AE%A1%E7%B3%BB%E7%BB%9F%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md) - [CNVD-2021-14544:Hikvision lettura arbitraria di file nel server di gestione streaming Hikvision](https://github.com/Henry4E36/Hikvision) - [CNVD-2020-25078:Divulgazione di informazioni sensibili in D-link, consente di ottenere direttamente le credenziali dell'account per visualizzare la sorveglianza](https://github.com/Henry4E36/D-link-information) - [ios-gamed-0day](https://github.com/illusionofchaos/ios-gamed-0day) - [ios-nehelper-wifi-info-0day](https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day) - [ios-nehelper-enum-apps-0day](https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day) - [iOS 15.0.1 RCE PoC](https://github.com/jonathandata1/ios_15_rce) - [DarkSword-RCE: exploit per l'esecuzione di codice remoto su Apple iOS](https://github.com/htimesnine/DarkSword-RCE)|[darksword-kexploit: exploit per il kernel di Apple iOS](https://github.com/opa334/darksword-kexploit)|[DarkSword: exploit per Apple iOS](https://github.com/ghh-jb/DarkSword) - [CVE-2021-36260: Vulnerabilità di iniezione di comandi nei prodotti Hikvision](https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html) - [CVE-2021-33044, CVE-2021-33045 POC per telecamere Dahua](https://github.com/mcw0/DahuaConsole)|[Analisi correlata](https://github.com/mcw0/PoC/blob/master/Dahua%20authentication%20bypass.txt)|[Plugin Chrome per bypass del login](https://github.com/bp2008/DahuaLoginBypass) - [CVE-2021-36260: vulnerabilità di command injection in Hikvision](https://github.com/rabbitsafe/CVE-2021-36260)|[Un altro script di exploit per CVE-2021-36260](https://github.com/Cuerz/CVE-2021-36260) - [CVE-2021-41653: TP-Link TL-WR840N V5(EU) - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/TP-Link%20TL-WR840N%20V5%28EU)%20-%20RCE%20-%20CVE-2021-41653.pdf) - [DirtyPipe-Android: exploit root Dirty Pipe per Android](https://github.com/polygraphene/DirtyPipe-Android) - [CVE-2022-30075: Tp-Link Archer AX50 Authenticated RCE](https://github.com/aaronsvk/CVE-2022-30075) - [NotQuite0day: vulnerabilità correlate a D-Link 1960](https://github.com/star-sg/NotQuite0day) - [HuaYuReportRCE: GetShell del componente Report di HuaYu ShuGuang](https://github.com/h0r1g/HuaYuReportRCE) - [IOT_Vul: raccolta di vulnerabilità IoT](https://github.com/zhefox/IOT_Vul) - [CameraHack: scansione e cracking in batch delle vulnerabilità comuni di telecamere Hikvision, Dahua e altre](https://github.com/WhaleFell/CameraHack) - [CVE-2022-32832: vulnerabilità di esecuzione di codice arbitrario nel kernel causata da apfs di apple macos](https://github.com/Muirey03/CVE-2022-32832) - [HookWechatRecall: Demo di intercettazione del ritiro messaggi di WeChat tramite lo strumento frida](https://github.com/GaoGuohao/HookWechatRecall) - [IOT_vuln: repository di vulnerabilità IoT](https://github.com/EPhaha/IOT_vuln) - [hikvision_CVE-2017-7921_auth_bypass_config_decryptor: decifra i file di configurazione Hikvision affetti da CVE-2017-7921](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor) - [CVE-2022-20866: verifica della fuga di chiavi private RSA nel software Cisco Adaptive Security Appliance e nel software Firepower Threat Defense](https://github.com/CiscoPSIRT/CVE-2022-20866) - [WLAN-AP-WEA453e RCE: vulnerabilità di esecuzione remota di comandi nel router Samsung](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/WLAN-AP-WEA453e%20RCE%E4%B8%89%E6%98%9F%E8%B7%AF%E7%94%B1%E5%99%A8%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md) - [Buffer overflow in Xiongmai DVRs](https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/)|[Backup](https://web.archive.org/web/20221129205148/https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/) - [CVE-2023-27350: RCE causata da bypass dell'autenticazione in PaperCut NG](https://github.com/horizon3ai/CVE-2023-27350) - [ivms-8700-0day-poc: vulnerabilità di upload arbitrario di file nella piattaforma di gestione della sicurezza integrata Hikvision iVMS-8700](https://github.com/spmonkey/ivms-8700-0day-poc) - [badspin: vulnerabilità di use-after-free nel kernel Android](https://github.com/0xkol/badspin) - [HikvisionIVMSGetShell: GetShell del software della piattaforma di gestione della sicurezza integrata Hikvision IVMS](https://github.com/Tas9er/HikvisionIVMSGetShell) - [iot: exploit per router della serie DIR-816 823g](https://github.com/sek1th/iot) - [VulIoT: exploit per router della serie DIR-816 823g](https://github.com/726232111/VulIoT) - [NsePocsuite-lua: script di rilevamento vulnerabilità per telecamere di rete. Nmap (Nse Nmap script engine)](https://github.com/foggyspace/NsePocsuite-lua) - [Approccio al vulnerability hunting sui dispositivi](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E6%80%9D%E8%B7%AF.html) - [Analisi della riproduzione della vulnerabilità di stack overflow nel firmware Vivotek CC8160](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/Vivotek%20CC8160%20%E5%9B%BA%E4%BB%B6%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%86%E6%9E%90.html) - [Vulnerability hunting CVE-2023-26315 nel router Xiaomi AX9000](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.html) - [IOT-CVE-2018-17066 (vulnerabilità di command injection D-Link)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/IOT-CVE-2018-17066%28D-Link%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html) - [Strumento di estrazione e brute force per firmware IoT cifrati con openssl](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E9%92%88%E5%AF%B9IoT%E5%9B%BA%E4%BB%B6%E7%9A%84openssl%E5%8A%A0%E5%AF%86%E7%9A%84%E6%8F%90%E5%8F%96%26%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%E5%B7%A5%E5%85%B7.html) - [Soluzione di emulazione del firmware del router Xiaomi](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%5B%E5%8E%9F%E5%88%9B%5D%20%E5%B0%8F%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%9B%BA%E4%BB%B6%E4%BB%BF%E7%9C%9F%E6%A8%A1%E6%8B%9F%E6%96%B9%E6%A1%88-%E6%99%BA%E8%83%BD%E8%AE%BE%E5%A4%87-%E7%9C%8B%E9%9B%AA-%E5%AE%89%E5%85%A8%E7%A4%BE%E5%8C%BA_%E5%AE%89%E5%85%A8%E6%8B%9B%E8%81%98_kanxue.com.html) - [Configurazione di un ambiente ARM64 con QEMU _ ZIKH26's Blog](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/QEMU%E6%90%AD%E5%BB%BAARM64%E7%8E%AF%E5%A2%83%20_%20ZIKH26%27s%20Blog.html) - [Riproduzione della vulnerabilità DIR-820 CVE-2022-26258](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/DIR-820%20CVE-2022-26258%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.html) - [Dall'analisi di jhttpd all'injection di comandi di sistema (CVE-2021-46227 - vulnerabilità di command injection D-Link Di-7200G)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E4%BB%8Ejhttpd%E5%88%86%E6%9E%90%E5%88%B0%E7%B3%BB%E7%BB%9F%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%28CVE-2021-46227-D-Link%20Di-7200G%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html) - [2024 RWCTF Synology BC500 telecamera RCE--non autorizzato_Stack Overflow](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/2024%20RWCTF%E7%BE%A4%E6%99%96%20BC500%E6%91%84%E5%83%8F%E5%A4%B4RCE--%E6%9C%AA%E6%8E%88%E6%9D%83_%E6%A0%88%E6%BA%A2%E5%87%BA.html) - [Estrazione manuale del firmware del router con dd---Estrazione del firmware del router PoE AC tutto-in-uno FR100P-AC di Fast](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%B7%AF%E7%94%B1%E5%99%A8dd%E6%89%8B%E5%8A%A8%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6---%E8%BF%85%E6%8D%B7PoEAC%E8%B7%AF%E7%94%B1%E4%B8%80%E4%BD%93%E6%9C%BAFR100P-AC%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.html) - [NX_Firmware: database dei firmware per le varie versioni di Nintendo Switch](https://github.com/THZoria/NX_Firmware) - [vphone-aio: script per eseguire con un solo comando un telefono virtuale iOS (vphone) già sbloccato e con bootstrap completo installato](https://github.com/34306/vphone-aio) - [AssppJailbroken: uno strumento per decifrare i file IPA più recenti scaricati dall'App Store, con supporto per l'esecuzione su dispositivi iOS jailbroken e simulatori iPhone](https://github.com/lbr77/AssppJailbroken) - [FirmWire: piattaforma di analisi dinamica a livello di sistema che supporta i firmware baseband Samsung Shannon e MediaTek, utilizzabile per fuzzing, analisi della causa radice delle vulnerabilità e debug](https://github.com/FirmWire/FirmWire) - [Podroid: esegue container Linux su telefoni Android senza root, avviando una macchina virtuale Alpine Linux basata su QEMU e fornendo un runtime container Podman completo](https://github.com/ExTV/Podroid) - [PrismSpace: gestore di doppia istanza delle app basato sul profilo di lavoro Android (managed profile)](https://github.com/yzddmr6/PrismSpace) - [Tsec-Salon: materiali delle passate edizioni del Tencent Security Salon](https://github.com/Yeti-791/Tsec-Salon)|[BLACKHAT_Asia2026: raccolta dei materiali delle sessioni di Black Hat Asia 2026](https://github.com/Mr-xn/BLACKHAT_Asia2026)|[Java Ghost Bits - PDF della presentazione a Black Hat Asia 2026 (Ghost Bits: troncamento dei bit alti)](https://i.blackhat.com/Asia-26/Presentations/Asia-26-Bai-Cast-Attack-Ghost-Bits-4.23.pdf)|[GBitsTools: strumento di attacco Ghost Bits (GUI/CLI Python)](https://github.com/shiyeshu/GBitsTools)|[GbitsGen: strumento di generazione di caratteri Ghost Bits](https://github.com/qi4L/GbitsGen)|[ghost-bits-lab: ambiente di laboratorio di sicurezza interattivo per Ghost Bits (Java)](https://github.com/Xc1Ym/ghost-bits-lab) - [CVE-2026-34908-check: strumento di rilevamento per il bypass dell'autenticazione e l'esecuzione di codice in modalità remota (RCE) non autorizzata su UniFi OS Server](https://github.com/BishopFox/CVE-2026-34908-check) | [Analisi tecnica correlata: Popping Root on UniFi OS Server](https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis) - [0成本搭建摄像头漏洞挖掘环境.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/0%E6%88%90%E6%9C%AC%E6%90%AD%E5%BB%BA%E6%91%84%E5%83%8F%E5%A4%B4%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E7%8E%AF%E5%A2%83.md) - [2021年物联网设备CVE天梯榜.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%B9%B4%E7%89%A9%E8%81%94%E7%BD%91%E8%AE%BE%E5%A4%87CVE%E5%A4%A9%E6%A2%AF%E6%A6%9C.md) - [2021强网杯赛题Mi Route复现.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%BC%BA%E7%BD%91%E6%9D%AF%E8%B5%9B%E9%A2%98Mi%20Route%E5%A4%8D%E7%8E%B0.md) - [2022 祥云杯 Misc super_electric WriteUp.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%20%E7%A5%A5%E4%BA%91%E6%9D%AF%20Misc%20super_electric%20WriteUp.md) - [2022河南工业互联网安全大赛复赛-工控Writeup.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%E6%B2%B3%E5%8D%97%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E5%A4%8D%E8%B5%9B-%E5%B7%A5%E6%8E%A7Writeup.md) - [2024中国工业互联网安全大赛智能家电行业赛道 writeup by Mini-Venom.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2024%E4%B8%AD%E5%9B%BD%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E6%99%BA%E8%83%BD%E5%AE%B6%E7%94%B5%E8%A1%8C%E4%B8%9A%E8%B5%9B%E9%81%93%20writeup%20by%20Mini-Venom.md) - [AFL源码分析系列——afl-fuzz(3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%E2%80%94%E2%80%94afl-fuzz%283).md) - [AFL源码分析系列（三）-- afl-llvm-mode.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%EF%BC%88%E4%B8%89%EF%BC%89--%20afl-llvm-mode.md) - [Analisi della vulnerabilità di stack overflow del router Asus.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Asus%20%E8%B7%AF%E7%94%B1%E5%99%A8%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md) - [Analisi del rom, reverse engineering, emulazione e fuzzing dell'MCU Atmel SAM Cortex-M7.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Atmel%20SAM%20Cortex-M7%20MCU%20rom%20%E5%88%86%E6%9E%90%EF%BC%8C%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%EF%BC%8C%E4%BB%BF%E7%9C%9F%E5%92%8C%E6%A8%A1%E7%B3%8A%E5%8C%96.md) - [Uso semplice di BooFuzz, con CVE-2018-5767 come esempio.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/BooFuzz%E7%9A%84%E7%AE%80%E5%8D%95%E4%BD%BF%E7%94%A8%EF%BC%8C%E4%BB%A5CVE-2018-5767%E4%B8%BA%E4%BE%8B.md) - [Stampante Brother VC-500W.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Brother%20VC-500W%20%E6%89%93%E5%8D%B0%E6%9C%BA.md) - [Note sul codice sorgente di boofuzz (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%80%EF%BC%89.md) - [Note sul codice sorgente di boofuzz (3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%89%EF%BC%89.md) - [Note sul codice sorgente di boofuzz (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md) - [“Hacking degli smartphone 5G” (1) Black Hat USA 2021: tramite baseband wireless - white paper sull'attacco RCE (Remote Code Execution) contro gli smartphone 5G.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E2%80%9C%E5%85%A5%E4%BE%B55G%E6%89%8B%E6%9C%BA%E2%80%9D%EF%BC%88%E4%B8%80%EF%BC%89Black%20Hat%20USA%202021%EF%BC%9A%E9%80%9A%E8%BF%87%E6%97%A0%E7%BA%BF%E5%9F%BA%E5%B8%A6-%E9%92%88%E5%AF%B95G%E6%99%BA%E8%83%BD%E6%89%8B%E6%9C%BA%E7%9A%84RCE%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%94%BB%E5%87%BB%E7%99%BD%E7%9A%AE%E4%B9%A6.md) - [Comprendere l'exploitation delle vulnerabilità su architettura ARM in un solo articolo.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E6%96%87%E8%AF%BB%E6%87%82ARM%E6%9E%B6%E6%9E%84%E4%B8%8B%E7%9A%84%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8.md) - [Un approccio al decifrare un firmware cifrato.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E7%A7%8D%E5%8A%A0%E5%AF%86%E5%9B%BA%E4%BB%B6%E7%9A%84%E8%A7%A3%E5%AF%86%E6%80%9D%E8%B7%AF.md) - [Dall'analisi di una 1day alla scoperta di una 0day.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E1day%E5%88%86%E6%9E%90%E5%88%B00day%E6%8C%96%E6%8E%98.md) - [La vulnerabilità del servizio DNS vista attraverso una challenge CTF.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%80%E9%81%93CTF%E9%A2%98%E7%9B%AE%E7%9C%8BDNS%E6%9C%8D%E5%8A%A1%E6%BC%8F%E6%B4%9E.md) - [Lo stack overflow su ARM visto attraverso tre challenge CTF.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%89%E9%81%93CTF%E8%B5%9B%E9%A2%98%E7%9C%8Barm%E6%A0%88%E6%BA%A2%E5%87%BA.md) - [Semplice scoperta di 0day dopo la lettura di <Riproduzione di vulnerabilità e semplice scoperta di 0day>.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E7%9C%8B%3C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%B0%E7%AE%80%E5%8D%950day%E6%BC%8F%E6%B4%9E%E6%8C%96%3E%E5%90%8E%E7%9A%84%E7%AE%80%E5%8D%950day%E6%8C%96%E6%8E%98.md) - [Configurazione dell'ambiente di emulazione del NetGear RAX50 da zero.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E9%9B%B6%E5%BC%80%E5%A7%8B%E7%9A%84NetGear%20RAX50%20%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA.md) - [Aggirare la protezione di lettura del Renesas RH850 tramite fault injection.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BD%BF%E7%94%A8%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E7%BB%95%E8%BF%87%E7%91%9E%E8%90%A8%20RH850%E7%9A%84%E8%AF%BB%E4%BF%9D%E6%8A%A4.md) - [Estrazione del firmware nrf52840 tramite fault injection di tensione side-channel.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BE%A7%E4%BF%A1%E9%81%93%E7%94%B5%E5%8E%8B%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E6%8F%90%E5%8F%96nrf52840%E5%9B%BA%E4%BB%B6.md) - [Sul problema dell'allineamento dell'indirizzo di esecuzione delle funzioni con istruzioni thumb2 e analisi del firmware di verifica.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%85%B3%E4%BA%8Ethumb2%E6%8C%87%E4%BB%A4%E4%B8%8B%E5%87%BD%E6%95%B0%E8%BF%90%E8%A1%8C%E5%9C%B0%E5%9D%80%E5%AF%B9%E9%BD%90%E9%97%AE%E9%A2%98%E5%8F%8A%E9%AA%8C%E8%AF%81%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90.md) - [Estrazione del firmware di un optical network terminal (ONT) tramite vulnerabilità di directory traversal.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%88%A9%E7%94%A8%E7%9B%AE%E5%BD%95%E7%A9%BF%E8%B6%8A%E6%BC%8F%E6%B4%9E%E5%AF%B9%E6%9F%90%E5%85%89%E7%8C%AB%E8%BF%9B%E8%A1%8C%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.md) - [Huawei HG532 - Breve analisi della vulnerabilità CVE-2017-17215.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAHG532%20-%20CVE-2017-17215%E6%BC%8F%E6%B4%9E%E7%AE%80%E6%9E%90.md) - [Repackaging del firmware e inserimento di backdoor nella serie Asus AC.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95AC%E7%B3%BB%E5%88%97%E5%9B%BA%E4%BB%B6%E9%87%8D%E6%89%93%E5%8C%85%E4%B8%8E%E5%90%8E%E9%97%A8%E6%A4%8D%E5%85%A5.md) - [Riproduzione delle vulnerabilità della serie Asus RT-AC68U (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%B8%80%EF%BC%89.md) - [Riproduzione delle vulnerabilità della serie Asus RT-AC68U (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md) - [Analisi dell'incapsulamento GSE nelle comunicazioni satellitari.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%80%9A%E4%BF%A1GSE%E5%B0%81%E8%A3%85%E8%A7%A3%E6%9E%90.md) - [Satellite Hacker Challenge | Cracking del protocollo IIC.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%BB%91%E5%AE%A2%E6%8C%91%E6%88%98%E8%B5%9B%20%7C%20IIC%E5%8D%8F%E8%AE%AE%E7%A0%B4%E8%A7%A3.md) - [Tecniche di analisi dei CGI nel firmware (3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%B8%89%EF%BC%89.md) - [Tecniche di analisi dei CGI nel firmware (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%BA%8C%EF%BC%89.md) - [Sicurezza del firmware - Function hijacking e patch.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6%E5%AE%89%E5%85%A8-%E5%87%BD%E6%95%B0%E5%8A%AB%E6%8C%81%E4%BB%A5%E5%8F%8Apatch.md) - [Post-exploitation di F5 BIG-IP basata su CVE-2022-1388.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8ECVE-2022-1388%E7%9A%84F5%20BIG-IP%E5%90%8E%E6%B8%97%E9%80%8F.md) - [Breve introduzione agli attacchi DMA basati su PCILeech e MemProcFS.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8EPCILeech%E5%92%8CMemProcFS%E7%9A%84DMA%E6%94%BB%E5%87%BB%E6%B5%85%E8%B0%88.md) - [Metodi di costruzione di ambienti di emulazione multi-architettura e script automatici.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%9A%E7%A7%8D%E6%9E%B6%E6%9E%84%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%9E%84%E5%BB%BA%E6%96%B9%E6%B3%95%E5%8F%8A%E8%87%AA%E5%8A%A8%E8%84%9A%E6%9C%AC.md) - [Come hackerare un purificatore d'aria^^.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95hack%E6%8E%89%E4%B8%80%E5%8F%B0%E7%A9%BA%E6%B0%94%E5%87%80%E5%8C%96%E5%99%A8%5E%5E.md) - [Come costruire da zero uno stack di protocollo Wi-Fi (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%881%EF%BC%89.md) - [Come costruire da zero uno stack di protocollo Wi-Fi (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%882%EF%BC%89.md) - [Come ottenere le chiavi del firmware EL3 tramite la modalità test.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E6%B5%8B%E8%AF%95%E6%A8%A1%E5%BC%8F%E8%8E%B7%E5%BE%97EL3%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6%E5%AF%86%E9%92%A5.md) - [Breve analisi del firmware Schneider NOE77101.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%AF%B9%E6%96%BD%E8%80%90%E5%BE%B7NOE77101%E5%9B%BA%E4%BB%B6%E6%B5%85%E6%9E%90.md) - [Riproduzione della vulnerabilità CVE-2023-26315 del router Xiaomi AX9000.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.md) - [Scoperta di vulnerabilità 0day nei router enterprise Cisco (versione semplificata).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%80%9D%E7%A7%91%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A80day%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%EF%BC%88%E6%B0%B4%E6%BC%8F%E6%B4%9E%E7%89%88%EF%BC%89.md) - [Guida passo passo all'analisi del firmware e alla scoperta di vulnerabilità nell'architettura MIPS.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%8B%E6%8A%8A%E6%89%8B%E5%B8%A6%E4%BD%A0%E5%88%86%E6%9E%90mips%E6%9E%B6%E6%9E%84%E4%B8%8B%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90%E4%B8%8E%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md) - [Analisi del protocollo Internet Printing Protocol (IPP) delle stampanti.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E4%B9%8BInternet%20Printing%20Protocol%28IPP)协议分析.md) - [Introduzione alla ricerca sulle vulnerabilità delle stampanti.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E6%BC%8F%E6%B4%9E%E7%A0%94%E7%A9%B6%E5%85%A5%E9%97%A8.md) - [Esplorazione del recupero dei nomi file in vxworks.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8E%A2%E7%A9%B6vxworks%E6%96%87%E4%BB%B6%E5%90%8D%E6%81%A2%E5%A4%8D.md) - [Estrazione del firmware di una bicicletta condivisa.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8F%90%E5%8F%96%E5%85%B1%E4%BA%AB%E5%8D%95%E8%BD%A6%E5%9B%BA%E4%BB%B6.md) - [Analisi della vulnerabilità di attacco DOS in H3C magicR100.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%96%B0%E5%8D%8E%E4%B8%89magicR100%E5%AD%98%E5%9C%A8DOS%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md) - [Introduzione alla sicurezza dei droni.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E5%AE%89%E5%85%A8%E7%AE%80%E4%BB%8B.md) - [Introduzione al protocollo di comunicazione dei droni MAVLink.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E9%80%9A%E4%BF%A1%E5%8D%8F%E8%AE%AEMAVLink%E7%AE%80%E4%BB%8B.md) - [Analisi inversa dei segnali di radiocomando.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E7%BA%BF%E9%81%A5%E6%8E%A7%E4%BF%A1%E5%8F%B7%E9%80%86%E5%90%91%E5%88%86%E6%9E%90.md) - [Raccolta delle vulnerabilità delle smart TV.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E7%94%B5%E8%A7%86%E6%BC%8F%E6%B4%9E%E6%B1%87%E6%80%BB.md) - [Analisi della sicurezza delle serrature intelligenti: esplorazione a tutto campo di hardware, firmware, app e cloud.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E9%97%A8%E9%94%81%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%EF%BC%9A%E5%A4%9A%E6%96%B9%E4%BD%8D%E6%8E%A2%E7%B4%A2%E7%A1%AC%E4%BB%B6%E3%80%81%E5%9B%BA%E4%BB%B6%E3%80%81app%E5%92%8C%E4%BA%91%E7%AB%AF.md) - [Estrazione e analisi del firmware di una telecamera T.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90T%E6%91%84%E5%83%8F%E5%A4%B4%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96%E5%88%86%E6%9E%90.md) - [Analisi del protocollo di una presa a muro intelligente di una certa marca.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E5%93%81%E7%89%8C%E6%99%BA%E8%83%BD%E5%A2%99%E5%A3%81%E6%8F%92%E5%BA%A7%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90.md) - [Vulnerabilità di esecuzione di comandi non autorizzata generica in una telecamera.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E6%91%84%E5%83%8F%E5%A4%B4%E5%AD%98%E5%9C%A8%E9%80%9A%E7%94%A8%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md) - [Analisi della vulnerabilità di esecuzione di comandi in un router di una certa marca.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md) - [Due approcci alla decifratura di un dispositivo di rete.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E8%A7%A3%E5%AF%86%E7%9A%84%E4%B8%A4%E7%A7%8D%E6%80%9D%E8%B7%AF.md) - [Analisi delle vulnerabilità di un router e studio di diversi metodi di sfruttamento dello stack overflow.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%A4%9A%E7%A7%8D%E6%A0%88%E6%BA%A2%E5%87%BA%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6.md) - [Patch e hook nel firmware emulato.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%A8%A1%E6%8B%9F%E5%9B%BA%E4%BB%B6%E4%B8%8B%E7%9A%84patch%E4%B8%8Ehook.md) - [Breve analisi del processo di invocazione tra cgi e lighttpd.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E6%9E%90cgi%E4%B8%8Elighttpd%E4%B9%8B%E9%97%B4%E7%9A%84%E8%B0%83%E7%94%A8%E8%BF%87%E7%A8%8B.md) - [Breve discussione sulla scoperta di vulnerabilità nei router.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E8%B0%88%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md) - [Dalla riproduzione di vulnerabilità alla semplice scoperta di vulnerabilità 0day.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%B0%E7%AE%80%E5%8D%950day%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md) - [Analisi del protocollo IoT MQTT.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91MQTT%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90.md) --- [Read more](https://github.com/mr-xn/penetration_testing_poc)
