{"vulnerability": "CVE-2021-30528", "sightings": [{"uuid": "606d04a3-a487-408a-bd8a-98fcd65725bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4481", "content": "#Red_Team_Tactics\n1. Escaping to Java to escape the Chrome sandbox (PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse: https://github.com/ollypwn/Certipy", "creation_timestamp": "2024-10-04T14:35:01.000000Z"}, {"uuid": "7b023ce3-d1ec-482e-993f-568a1ec1daa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4567", "content": "Apple has released urgent iOS 15.0.2 and iPadOS 15.0.2 updates to address a new critical 0-day vulnerability (CVE-2021-30883) that is being actively exploited in the wild.\nRead details: \nhttps://thehackernews.com/2021/10/apple-releases-urgent-iphone-and-ipad.html\n\nexploit\n1. Scripts for Buffer Overflow challenges\nhttps://github.com/Twigonometry/buffer-overflow-scripts\n2. Exploits Scripts and other tools that are useful during Penetration-Testing or Red Team engagement\nhttps://github.com/BlackSnufkin/PT-ToolKit\n\nOffensive security\n1. HTTP server for exfiltrating files/data\nhttps://github.com/IngoKl/HTTPUploadExfil\n2. WAF Bypassing with Unicode Compatibility\nhttps://jlajara.gitlab.io/web/2020/02/19/Bypass_WAF_Unicode.html\n\nRed Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nAnalytics\nA Modern Exploration of Windows Memory Corruption Exploits: Stack Overflows\nhttps://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-01T17:00:38.285144Z"}, {"uuid": "533a4521-b848-4471-a939-6cc86b208d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4564", "content": "Red Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nUnofficial Common Log File System (CLFS) Documentation\nhttps://github.com/ionescu007/clfs-docs\n\nThreat Research\n1. Analysis of Virtualization-based Obfuscation\nhttps://github.com/mrphrazer/r2con2021_deobfuscation\n2. Secure implementation of WebView in iOS applications\nhttps://www.securing.pl/en/secure-implementation-of-webview-in-ios-applications\n\nBlue Team Techniques\nA PoC tool for analyzing a rogue DNS server\ud83d\udc4d\ud83c\udffd\nhttps://github.com/ninoseki/rogue_one\n\n\nOffensive security\n1. Backdoor .NET assemblies with\u2026 dnSpy\nhttps://rastamouse.me/backdoor-net-assemblies-with-dnspy-%f0%9f%a4%94\n2. Python3 tool to perform password spraying using RDP\ud83d\ude3c\nhttps://github.com/xFreed0m/RDPassSpray\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-01T17:00:38.564381Z"}, {"uuid": "5076a2fb-a42a-4c92-a8bc-e72a1c4ddaef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4553", "content": "Red Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nAnalytics\nA Modern Exploration of Windows Memory Corruption Exploits: Stack Overflows\nhttps://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows\n\nOffensive security\nPre-Auth SSRF To Full MailBox Access\n(Microsoft Exchange Server Exploit)\ud83d\ude00\nhttps://vanshal.medium.com/pre-auth-ssrf-to-full-mailbox-access-microsoft-exchange-server-exploit-a62c8ac04b47\n\nThreat Research\n1. Tale of two hypervisor bugs -\nEscaping from FreeBSD bhyve\nhttp://phrack.org/issues/70/11.html#article\n2. LPE in Firefox on Windows\nhttps://deepsurface.com/deepsurface-security-advisory-lpe-in-firefox-on-windows\n\nexploit\nCVE-2021-42013:\nApache 2.4.50 Path traversal vulnerability\nhttps://github.com/Vulnmachines/cve-2021-42013\n]-> Exploit with integrated shodan search:\nhttps://github.com/andrea-mattioli/apache-exploit-CVE-2021-42013", "creation_timestamp": "2026-09-01T17:00:38.715333Z"}, {"uuid": "d93d3300-4f6b-4e4f-bdd5-cc5e74b4cbdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4564", "content": "Red Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nUnofficial Common Log File System (CLFS) Documentation\nhttps://github.com/ionescu007/clfs-docs\n\nThreat Research\n1. Analysis of Virtualization-based Obfuscation\nhttps://github.com/mrphrazer/r2con2021_deobfuscation\n2. Secure implementation of WebView in iOS applications\nhttps://www.securing.pl/en/secure-implementation-of-webview-in-ios-applications\n\nBlue Team Techniques\nA PoC tool for analyzing a rogue DNS server\ud83d\udc4d\ud83c\udffd\nhttps://github.com/ninoseki/rogue_one\n\n\nOffensive security\n1. Backdoor .NET assemblies with\u2026 dnSpy\nhttps://rastamouse.me/backdoor-net-assemblies-with-dnspy-%f0%9f%a4%94\n2. Python3 tool to perform password spraying using RDP\ud83d\ude3c\nhttps://github.com/xFreed0m/RDPassSpray\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-02T01:04:23.417853Z"}, {"uuid": "bf5483f9-504e-4ce3-a1a6-4fb7a61997b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4567", "content": "Apple has released urgent iOS 15.0.2 and iPadOS 15.0.2 updates to address a new critical 0-day vulnerability (CVE-2021-30883) that is being actively exploited in the wild.\nRead details: \nhttps://thehackernews.com/2021/10/apple-releases-urgent-iphone-and-ipad.html\n\nexploit\n1. Scripts for Buffer Overflow challenges\nhttps://github.com/Twigonometry/buffer-overflow-scripts\n2. Exploits Scripts and other tools that are useful during Penetration-Testing or Red Team engagement\nhttps://github.com/BlackSnufkin/PT-ToolKit\n\nOffensive security\n1. HTTP server for exfiltrating files/data\nhttps://github.com/IngoKl/HTTPUploadExfil\n2. WAF Bypassing with Unicode Compatibility\nhttps://jlajara.gitlab.io/web/2020/02/19/Bypass_WAF_Unicode.html\n\nRed Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nAnalytics\nA Modern Exploration of Windows Memory Corruption Exploits: Stack Overflows\nhttps://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-02T01:04:23.224095Z"}, {"uuid": "69b8d49b-8ea5-492c-bd33-8b87b80c46be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30528", "type": "seen", "source": "https://t.me/cissp/4553", "content": "Red Team Tactics\n1. Escaping to Java to escape the Chrome sandbox\n(PoC for CVE-2021-30528)\nhttps://securitylab.github.com/research/chrome_sbx_java\n2. Abusing Weak ACL on Certificate Templates\nhttps://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates\n]-> Python implementation for AD certificate abuse:\nhttps://github.com/ollypwn/Certipy\n\nAnalytics\nA Modern Exploration of Windows Memory Corruption Exploits: Stack Overflows\nhttps://www.forrest-orr.net/post/a-modern-exploration-of-windows-memory-corruption-exploits-part-i-stack-overflows\n\nOffensive security\nPre-Auth SSRF To Full MailBox Access\n(Microsoft Exchange Server Exploit)\ud83d\ude00\nhttps://vanshal.medium.com/pre-auth-ssrf-to-full-mailbox-access-microsoft-exchange-server-exploit-a62c8ac04b47\n\nThreat Research\n1. Tale of two hypervisor bugs -\nEscaping from FreeBSD bhyve\nhttp://phrack.org/issues/70/11.html#article\n2. LPE in Firefox on Windows\nhttps://deepsurface.com/deepsurface-security-advisory-lpe-in-firefox-on-windows\n\nexploit\nCVE-2021-42013:\nApache 2.4.50 Path traversal vulnerability\nhttps://github.com/Vulnmachines/cve-2021-42013\n]-> Exploit with integrated shodan search:\nhttps://github.com/andrea-mattioli/apache-exploit-CVE-2021-42013", "creation_timestamp": "2026-09-02T01:04:23.653170Z"}]}