CVE-2020-6287

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)

PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability) Pffff! RECON (Remotely Exploitable Code On NetWeaver)? Guys, really? That was the best codename you came up with? :) This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and as a PoC script exploits directory traversal in queryProtocol method Directory traversal allows to

Vulnerability Assessment and Indicator of Compromise (IoC) Scanner for CVE-2020-6287 (RECON) RECON (Remotely Exploitable Code On NetWeaver) is a critical (CVSSv3 10) vulnerability affecting a number of SAP business and technical applications running on top of the SAP NetWeaver Java stack This vulnerability was discovered by the Onapsis Research Labs, which collaborated closely

PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from metasploit. Original Metasploit PR module: https://github.com/rapid7/metasploit-framework/pull/13852/commits/d1e2c75b3eafa7f62a6aba9fbe6220c8da97baa8 This PoC only create user with unauthentication permission and no more admi…

CVE-2020-6287-exploit PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set Inspired by @zeroSteiner from metasploit Original Metasploit PR module: githubcom/rapid7/metasploit-framework/pull/13852/commits/d1e2c75b3eafa7f62a6aba9fbe6220c8da97baa8 This PoC only create user with unauthenticated permission and no more administrator pe

SAP penetration testing Web and network cheatsheet

SAP-Pentest-Cheatsheet Bismillah For conducting the Pentest you should deploy SAP System on your Network SAP Web Interface Vulnerability Open Redirection Check HOST/sap/public/bc/icf/logoff?redirecturl=MALICIOUSURL Unsecured Protocol (HTTP) Check HOST:PORT/startPage HOST:PORT/sap/public/info System Informational Misconfiguration Check HOST:POR

Checker help to verify created account or find it's mandat

SAP_CVE-2020-6287_find_mandate Checker help to verify created account or find it's mandat The script allows you to check whether the account was created when using the exploit RECONpy or find the mandate of the created account Exploit: githubcom/chipik/SAP_RECON Quick start: chmod +x /checker_CVE-2020-6287sh <start mndt> <stop mndt>

sap netweaver portal add user administrator

CVE-2020-6287-Sap-Add-User sap netweaver portal add user administrator

[CVE-2020-6287] SAP NetWeaver AS JAVA (LM Configuration Wizard) Authentication Bypass (Create Simple & Administrator Java User)

[CVE-2020-6287] SAP NetWeaver AS JAVA (LM Configuration Wizard) Authentication Bypass (Create Simple & Administrator Java User) SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite SAP NetWeaver is a service-oriented application and integration platform that provides a development and

Starter kit for SAP pentesting

SAP Comptes sapcom Deux types de comptes sapcom : P-User : Utilisateur public, qui peut participer à la communauté en ligne mais n'a pas accès à toutes les ressources S-User : Compte des servives utilisé par les clients et les partenaires SAP Permet notamment de télécharger des softs SAP comme le NW RFC SDK Ce type d

Templates are the core of nuclei scanner which power the actual scanning engine This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community We hope that you also contribute by sending templates via pull requests and grow the list Template Directory ├── LICENSE ├── READMEmd ├── basic-dete