Alternatives to FrSIRT – Where to Download Exploits?

Use Netsparker


Since FrSIRT closed it’s public archives and starting charging for access (blaming it on French laws…), people have been wondering where they can their dose of Exploits..For legitimate purposes obviously.

Security Forest

The most comprehensive collection in my opinion comes from SecurityForest. They also have a BETA exploitation framework in development, something like a Metasploit, but with a much larger range of exploits.

The part of SecurityForest you need to look at is the Exploit Tree.

I love the way it works, as it’s based on CVS, so you just download whatever you don’t have everytime you update.

The ExploitTree is a categorized collection of ALL available exploit code. ExploitTree’s ambition is to become the most organized, rich and up-to-date exploit repository on the internet. The ExploitTree is based on CVS (Concurrent Versioning System) and therefore allows the user to keep an up-to-date offline mirror of the repository on their hard drive. When an ExploitTree Administrator updates their local copy with a new/updated exploit, it updates the repository and keeps everyone else up-to-date. Furthermore, a web interface for web browsing is available.

It is a really impressive collection and very well categorised. It works fine on both Windows and *nix based systems. You can also browse online here.

milw0rm

milw0rm is less mainstream and started out as a personal site, but has grown into a comprehensive and well organised archive of exploits.

It can be organised various ways, by platform, by port, for PHP, for ASP etc.

Securiteam

Securiteam is quite commercial, but has an archive of verified exploits – going back to 1998, verified by their own team of ‘experts’. Note however Securiteam isn’t greatly liked on lists such as Full Disclosure (mostly for spamming their blog).

Securiteam Exploits Archive.

SecuriTeam™ is a group within Beyond Security® dedicated to bringing you the latest news and utilities in computer security.

Having experience as Security Specialists, Programmers and System Administrators we appreciate your need for a “Security Portal” – A central Security web site containing all the newest security information from various mailing lists, hacker channels and our own tools and knowledge.

Packetstorm

Packetstorm is one of the oldest sites, and has a reasonbly good archive of exploits.

Packetstorm Exploits

It goes back to about 1998 too.

Packet Storm offers an abundant resource of up-to-date and historical security tools, exploits, and advisories. We are a non-profit organization comprised of security professionals that are dedicated to providing the information necessary to secure networks on a global scale. We accomplish this goal by publishing new security information on a global network of websites.

Others

You can also check out:

Government Security Archive
Secwatch
Hackers Playground

Various

You can find the odd private archives online too, but they tend to go up and down, and sometimes when you have something specific in mind, it’s just best to hit Google and Google Groups to mine it out.

Don’t forget the good stuff like Google Hacking too.

Plus the Security and Hacking LiveCD’s have quite a lot of compiled & working exploits inside too.

Digg This Article

Posted in: Exploits/Vulnerabilities, Hacking Tools

, ,


Latest Posts:


Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.
CloudFrunt - Identify Misconfigured CloudFront Domains CloudFrunt – Identify Misconfigured CloudFront Domains
CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions.
Airbash - Fully Automated WPA PSK Handshake Capture Script Airbash – Fully Automated WPA PSK Handshake Capture Script
Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.
XXEinjector - Automatic XXE Injection Tool For Exploitation XXEinjector – Automatic XXE Injection Tool For Exploitation
XXEinjector is an XXE Injection Tool that automates retrieving files using direct and out of band methods. Directory listing only works in Java applications.
Yahoo! Fined 35 Million USD For Late Disclosure Of Hack Yahoo! Fined 35 Million USD For Late Disclosure Of Hack
Ah Yahoo! in trouble again, this time the news is Yahoo! fined for 35 million USD by the SEC for the 2 year delayed disclosure of the massive hack, we actually reported on the incident in 2016 when it became public.
Drupwn - Drupal Enumeration Tool & Security Scanner Drupwn – Drupal Enumeration Tool & Security Scanner
Drupwn is a Python-based Drupal Enumeration Tool that also includes an exploit mode, which can check for and exploit relevant CVEs.


3 Responses to Alternatives to FrSIRT – Where to Download Exploits?

  1. st3f April 26, 2006 at 9:12 am #

    Damn… I was gonna suggest checking the live CDs but you spoiled it at last line… bastard. Great post though!

  2. Darknet April 27, 2006 at 2:38 am #

    st3f: Yah I’m on it man, got in there before yeh!

  3. Dave April 27, 2006 at 10:51 am #

    Here are a couple more links:

    http://elsenot.com/
    http://www.hack.co.za/

    cheers,