Bhanunamikaze
Source-scoped identity with 4 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
GitHubBhanunamikaze/WP2Shell-CVE-2026-63030-POC
Repository PoCStars: 0Created 2026-07-21Model review verdict: Suspicious behavior.ExploitCVE-2026-60137CVE-2026-630306 files
AnalysisSuspicious behavior
Technical assessment
The artifact is a Python script that implements a full payload withheldation chain for CVE-2026-63030 and CVE-2026-60137, including route confusion detection, timing-based SQL injection, credential extraction, webshell upload, and command execution. It also contains scanner-like fingerprinting and validation functions, but the primary purpose is payload withheldation.
Backdoor review
Suspicious behaviorThe README presents the tool as a non-destructive scanner and validator, but the supplied Python script contains a fully implemented 'payload withheld' command that performs state-changing actions including webshell upload, credential extraction, and backdoor plugin installation. The README's claim that the 'remote' command is a stub is contradicted by the presence of a complete, functional 'payload withheld' function. This material misrepresentation of the tool's capabilities creates concern.
Classification basis and observed behavior
Classification basis
The script's 'payload withheld' command implements a full attack chain: route confusion detection, SQL injection, credential theft, webshell upload, and arbitrary command execution. The README describes it as a 'PoC payload withhelder' and the code contains functions for data extraction, file writing, and backdoor installation, which are characteristic of an payload withheld.
WP2Shell_CVE-2026-63030_POC.py:1-11WP2Shell_CVE-2026-63030_POC.py:1344-1444README.md:1-18Requirements
- Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API batch endpoint exposed.
README.md:84-90 - The route confusion vulnerability (CVE-2026-63030) must be payload withheldable on the target.
WP2Shell_CVE-2026-63030_POC.py:1361-1371
Observed behavior
- Sends a safe route confusion probe to confirm the batch-route desynchronization vulnerability.
WP2Shell_CVE-2026-63030_POC.py:1361-1371 - Performs timing-based blind SQL injection to confirm the SQLi vulnerability.
WP2Shell_CVE-2026-63030_POC.py:1383-1394 - Attempts direct webshell upload by extracting DOCUMENT_ROOT via /proc/self/environ and using INTO OUTFILE.
WP2Shell_CVE-2026-63030_POC.py:1399-1401 - Extracts admin password hash via blind SQL injection and attempts to crack it or prompts for password.
WP2Shell_CVE-2026-63030_POC.py:1294-1330 - Creates a new administrator user and uploads a backdoor plugin for command execution.
WP2Shell_CVE-2026-63030_POC.py:1413-1443
Behaviors behind the backdoor verdict
Flagged behaviors
- The README states the 'remote' command is a stub ('payload withheld() is currently a stub and returns an error'), but the script contains a fully implemented 'payload withheld' function (lines 1763-1828) that performs remote scanning, including active probing.
README.md:292-293WP2Shell_CVE-2026-63030_POC.py:1763-1828 - The README emphasizes non-destructive, safe validation and states the tool 'does not need to extract data or execute commands', but the script includes an 'payload withheld' command that performs credential extraction, webshell upload, and backdoor plugin installation.
README.md:127WP2Shell_CVE-2026-63030_POC.py:1344-1444
Observables
- Command
- Payload withheldThe script defines an 'payload withheld' subcommand that performs state-changing actions including webshell upload, credential extraction, and backdoor plugin installation, contradicting the README's focus on non-destructive scanning.
WP2Shell_CVE-2026-63030_POC.py:1488-1503 - Function
- Payload withheldThe README claims this function is a stub, but it is fully implemented and functional, indicating a discrepancy between documentation and code.
WP2Shell_CVE-2026-63030_POC.py:1763-1828
What the analysis did not establish
- The evidence includes only two text files (README.md and the main Python script) out of six total files in the repository. The other four files are unclassified and not analyzed, so the full artifact may contain additional components.
- The analysis is based solely on static code review; the code was not executed, and its effectiveness or safety is not verified.
- Only the two text files (README.md and WP2Shell_CVE-2026-63030_POC.py) were reviewed; four other files in the repository were not inspected.
- The review does not assess the safety or correctness of the payload withheld code itself, only the discrepancy between its presence and the documentation.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBhanunamikaze/BadHost-CVE-2026-48710-Exploit
Repository PoCStars: 1Created 2026-05-28ScannerCVE-2026-4871012 files
Analysis
Technical assessment
A detection-only scanner for CVE-2026-48710 (BadHost) in Starlette/FastAPI. It sends crafted Host and X-Forwarded-Host headers to test if authentication middleware that reads request.url.path can be bypassed, and reports differential results without exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a detection-only scanner and a local lab for CVE-2026-48710. All reviewed source code performs expected vulnerability scanning and demonstration behavior. No concealed executable behavior, persistence, credential theft, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact is a scanner. The README explicitly states it is a 'Detection-only scanner' (line 3). The main script's docstring says 'Detection-only scanner for Starlette/FastAPI Host-header URL reconstruction issues' (lines 5-8). The code sends crafted requests to observe differential responses and reports findings, but does not attempt to extract data, establish persistence, or perform any post-bypass actions. It is designed to detect the vulnerability, not exploit it.
README.md:1-3badhost_openapi_scanner.py:2-8Requirements
- Target must be a Starlette/FastAPI application with authentication middleware that uses request.url.path for security decisions.
README.md:3 - Scanner requires Python 3.9+ with no third-party dependencies.
README.md:66
Observed behavior
- Sends a baseline unauthenticated request to a protected endpoint and confirms it is denied (401/403).
badhost_openapi_scanner.py:481 - Sends a crafted request with a malformed Host header containing an allowlisted path to test if the auth gate is bypassed.
badhost_openapi_scanner.py:374-379 - Classifies the differential response as CONFIRMED, SUSPECT, REJECTED, BLOCKED, or OPEN based on status codes.
badhost_openapi_scanner.py:382-406 - Outputs a text summary, JSON, or CSV report of vulnerable endpoints without dumping response bodies or secrets.
badhost_openapi_scanner.py:977-1008
Behaviors behind the backdoor verdict
Observables
- Scanner Behavior
- Payload withheldThis is the documented purpose of the CVE-2026-48710 scanner and matches the vulnerability description.
badhost_openapi_scanner.py:374-379badhost_openapi_scanner.py:444-467 - Lab Application
- Payload withheldThe lab app is explicitly documented as vulnerable and is designed to demonstrate the CVE locally. It does not perform any hidden actions.
badhost_vuln_lab/app_vulnerable.py:1-11badhost_vuln_lab/app_vulnerable.py:41-64 - Network Communication
- Payload withheldThis is required for the scanner to function. No data exfiltration to unrelated third parties is present; all connections are to targets specified by the operator.
badhost_openapi_scanner.py:250-323
What the analysis did not establish
- Evidence includes only 5 of 12 files; 7 files are omitted with no content provided. The omitted files may contain additional context.
- The analysis is based solely on static review of the provided text; no dynamic execution or network traffic was observed.
- 7 files in the repository are not included in the evidence packet and were not reviewed. The analysis covers only the 5 text files provided.
- Binary content, if any, was not analyzed per the evidence policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBhanunamikaze/CVE-2026-2587-Exploit-POC
Repository PoCStars: 1Created 2026-05-20ScannerCVE-2026-25877 files
Analysis
Technical assessment
A Python-based validator that checks for CVE-2026-2587, an Expression Language (EL) injection vulnerability in Eclipse GlassFish. It sends benign arithmetic EL probes (e.g., #{7*7}) via the gadget handler and checks if the server evaluates them, confirming exposure without executing malicious commands.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python script (CVE-2026-2587-Exploit-POC.py) and its README.md. The script is a proof-of-concept validator for CVE-2026-2587, a GlassFish EL injection vulnerability. It hosts benign XML canaries, sends authenticated requests to the GlassFish admin console gadget handler, and checks whether EL expressions are evaluated server-side. The code performs only the described vulnerability validation: it serves XML, makes HTTP requests, and classifies responses. No backdoor, concealed payload, persistence mechanism, credential exfiltration, or unrelated remote access behavior is present. The script's behavior is fully consistent with its stated purpose as a security testing tool.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is to detect and validate the presence of CVE-2026-2587 by sending benign probes and checking for EL evaluation. It does not execute arbitrary commands, establish reverse shells, or perform any post-exploitation actions. The README explicitly states it performs 'benign EL evaluation only — no command execution, no reverse shell, no file upload, no persistence'.
README.md:885CVE-2026-2587-Exploit-POC.py:1-5Requirements
- Requires a valid admin session (cookie or credentials) for the target GlassFish admin console.
CVE-2026-2587-Exploit-POC.py:15-16 - Requires a callback URL reachable by the target GlassFish server to host the benign XML probe.
CVE-2026-2587-Exploit-POC.py:20-24
Observed behavior
- Sends a GET request to the GlassFish gadget handler with a URL pointing to a hosted XML file containing EL expressions.
CVE-2026-2587-Exploit-POC.py:730-737 - Checks the HTTP response body for the evaluated result of the arithmetic expression (e.g., '49' for #{7*7}) to determine if EL injection is present.
CVE-2026-2587-Exploit-POC.py:666-704 - Classifies the target as VULNERABLE, NOT_VULNERABLE, AUTH_REQUIRED, or INCONCLUSIVE based on the response analysis.
CVE-2026-2587-Exploit-POC.py:682-704 - Supports brute-forcing common GlassFish credentials to obtain an authenticated session.
CVE-2026-2587-Exploit-POC.py:402-473
Behaviors behind the backdoor verdict
Observables
- Network Behavior
- Payload withheldThis is the core functionality of the PoC validator and is expected for a tool that tests a server-side request forgery / EL injection vulnerability.
CVE-2026-2587-Exploit-POC.py:250-295CVE-2026-2587-Exploit-POC.py:730-737 - Credential Handling
- Payload withheldThese are used solely to authenticate to the target GlassFish admin console for vulnerability testing. No credentials are exfiltrated; they are only sent to the user-specified target.
CVE-2026-2587-Exploit-POC.py:330-348CVE-2026-2587-Exploit-POC.py:351-399 - File Operation
- Payload withheldThis is a standard reporting feature for a security scanning tool. The file path is provided by the user via --csv argument.
CVE-2026-2587-Exploit-POC.py:1080-1093
What the analysis did not establish
- Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 4 files were unclassified and 1 non-text media file was not inspected. The analysis is based solely on the provided Python script and README.
- The artifact's behavior is inferred from static code analysis; the code was not executed.
- Five files in the repository (including one non-text media file) were not included in the text evidence. Their metadata is present but content was not analyzed. The reviewed text files are the primary executable script and its documentation, which are the most relevant for backdoor analysis.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.