{"vulnerability": "cve-2021-33766", "sightings": [{"uuid": "2d0352eb-f246-4c37-953f-f6845d2f9b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "731942f9-8e3d-453b-b7e2-c25159bfe244", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "MISP/00164a7c-c08c-4000-8374-dfedac15ec01", "content": "", "creation_timestamp": "2024-11-14T06:09:51.000000Z"}, {"uuid": "191c12d4-8850-4ede-a9b4-7516e29bd469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/04/april-2021-update-tuesday-packages-now-available/", "content": "", "creation_timestamp": "2021-04-13T05:00:00.000000Z"}, {"uuid": "700f4c9f-97e6-420c-a47b-a39107ac21de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971218", "content": "", "creation_timestamp": "2024-12-24T20:26:02.677051Z"}, {"uuid": "45ad9750-5324-444d-b7e1-193200162f8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:30.000000Z"}, {"uuid": "b6344682-89d6-4eea-ae34-6c3c79260d5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-33766.yaml", "content": "", "creation_timestamp": "2025-10-10T11:00:42.000000Z"}, {"uuid": "7ebc4d8d-940d-49fa-a926-a9d2f55990f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m344f7j7me2e", "content": "", "creation_timestamp": "2025-10-13T21:02:40.197542Z"}, {"uuid": "174db2da-b4cf-4bdf-aeec-7f6bae4a15e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-33766", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cdd0509c-13a8-434f-b6b7-ee739c352653", "content": "", "creation_timestamp": "2026-02-02T12:28:27.586943Z"}, {"uuid": "4e0b53c1-28d9-4415-9eb1-192985bbcc74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/439", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server POC exploit\nURL\uff1ahttps://github.com/bhdresh/CVE-2021-33766-ProxyToken", "creation_timestamp": "2021-08-31T22:58:45.000000Z"}, {"uuid": "93a8f89f-5ccd-4c75-b777-27c3bc72e2de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/532", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-33766-poc\nURL\uff1ahttps://github.com/demossl/CVE-2021-33766-ProxyToken", "creation_timestamp": "2021-09-15T09:20:05.000000Z"}, {"uuid": "e322aa6d-c0c8-4ea5-ae81-601cad0899c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/530", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-33766-poc\nURL\uff1ahttps://github.com/demossl/CVE-2021-33766-ProxyToken-", "creation_timestamp": "2021-09-15T09:11:04.000000Z"}, {"uuid": "19deac40-f276-46da-a98c-8359a337d145", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cKure/6874", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 The bug (CVE-2021-33766) is an information-disclosure issue that could reveal victims' personal information, sensitive company data and more.\n\nhttps://threatpost.com/microsoft-exchange-proxytoken-email/169030/", "creation_timestamp": "2021-08-30T21:16:05.000000Z"}, {"uuid": "46111bd4-58f4-486d-b3cd-e4196ba4c1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/691", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server POC exploit\nURL\uff1ahttps://github.com/bhdresh/CVE-2021-33766", "creation_timestamp": "2021-10-14T12:35:09.000000Z"}, {"uuid": "b1f1aa5d-ba3a-4f6c-adb0-602e8d126d41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7606", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 POC Exploit for CVE-2021-33766 (ProxyToken).\n\nhttps://github.com/bhdresh/CVE-2021-33766", "creation_timestamp": "2021-10-14T13:23:38.000000Z"}, {"uuid": "956eb00e-1718-4005-985b-9daf0f20bef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/codeby_sec/4912", "content": "\u200b\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Microsoft \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33766) \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft Exchange Server, \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c ProxyToken, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.\n\nMicrosoft Exchange \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0432\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430:  \u0432\u043d\u0435\u0448\u043d\u0438\u0439 - \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 - \u0441\u0430\u0439\u0442, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \"Delegated Authentication\", \u043a\u043e\u0433\u0434\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u0441\u0430\u0439\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439. Exchange \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 (\u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0434\u0443\u043b\u044c, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0439 \u0437\u0430 \u044d\u0442\u043e, (\"DelegatedAuthModule\") \u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d).\n\n\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u043c\u0435\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exchange, \u0447\u0442\u043e \u0438 \u0436\u0435\u0440\u0442\u0432\u0430. \u041e\u0434\u043d\u0430\u043a\u043e, \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u043a\u0438 \u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438, \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0435 \u043d\u0443\u0436\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n#infosec #microsoft #exploit", "creation_timestamp": "2021-08-31T11:43:15.000000Z"}, {"uuid": "27ec8c2a-6e70-4530-8949-b3c6a76646f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/438", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server POC exploit\nURL\uff1ahttps://github.com/bhdresh/CVE-2021-33766-ProxyToken-", "creation_timestamp": "2021-08-31T22:54:11.000000Z"}, {"uuid": "1decac23-98f1-43bd-bc1c-988488be403c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/arpsyndicate/1329", "content": "#ExploitObserverAlert\n\nCVE-2021-33766\n\nDESCRIPTION: Exploit Observer has 17 entries related to CVE-2021-33766. Microsoft Exchange Information Disclosure Vulnerability\n\nFIRST-EPSS: 0.930380000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T23:14:42.000000Z"}, {"uuid": "077e199d-88ac-47b1-88bb-5fb936725453", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/276", "content": "ProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server #poc exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n#poc CVE-2021-37980 : Inappropriate implementation in Sandbox (windows only)\nhttps://github.com/ZeusBox/CVE-2021-37980\n\nMy take on CVE-2021-30858 #poc for ps4 8.xx It's just a POC\nhttps://github.com/PeterMxx/ps4_8.00_vuln_poc\n\nA simple Python proof of concept for CVE-2021-38295\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC\n\napache httpd path traversal checker(CVE-2021-41773 / CVE-2021-42013)\nhttps://github.com/theLSA/apache-httpd-path-traversal-checker", "creation_timestamp": "2021-10-15T12:57:52.000000Z"}, {"uuid": "bdc0695d-715d-439e-ab5c-84d829569b20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/186", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-18T23:06:09.000000Z"}, {"uuid": "1ee04f8a-70ee-4b73-9885-19a41968cb95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/true_secator/2054", "content": "\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043d\u043e\u0432\u044b\u0435 \u0433\u043e\u0440\u0438\u0437\u043e\u043d\u0442\u044b, \u0438\u043b\u0438 \u0442\u043e\u0447\u043d\u0435\u0435 \u0432\u044b\u0440\u0430\u0437\u0438\u043c\u0441\u044f, \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u043e\u0442\u043a\u0440\u044b\u043b\u0438\u0441\u044c \u043f\u0435\u0440\u0435\u0434 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u0438\u043c\u0447\u0438\u0432\u044b\u043c\u0438 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Zero-Day Initiative.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u044c\u0435\u0442\u043d\u0430\u043c\u0441\u043a\u0438\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u041b\u0435 \u0421\u0443\u0430\u043d\u043e\u043c \u0422\u0443\u0435\u043d\u043e\u043c \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 VNPT ISC \u0432 \u043c\u0430\u0440\u0442\u0435 2021 \u0433\u043e\u0434\u0430. \u0421\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0438\u044e\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u043e\u0434\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Exchange Server, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0443\u0441\u043b\u043e\u0432\u043d\u043e\u0435 \u043d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 ProxyToken (CVE-2021-33766). \n\n\u0411\u0430\u0433\u0430 \u043f\u043e \u043f\u0440\u043e\u0433\u043d\u043e\u0437\u0430\u043c \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u043e\u0432, \u0434\u043e\u043b\u0436\u043d\u0430 \u043d\u0430\u0447\u0430\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0438 ProxyShell.\n\nProxyToken \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u044f\u0449\u0438\u043a\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0433\u0434\u0435 \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u043a\u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0438 \u0432\u043d\u043e\u0441\u0438\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u0430\u043d\u0435\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Exchange (ECP), \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440 \u043c\u043e\u0436\u0435\u0442 \u0437\u0435\u0440\u043a\u0430\u043b\u0438\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a. \n\n\u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043d\u0435\u043f\u0443\u0441\u0442\u043e\u0439 \u0444\u0430\u0439\u043b cookie \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u00abSecurityToken\u00bb \u0441 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (\u0441\u0430\u0439\u0442 Microsoft Exchange, Outlook Web Access, Exchange Control Panel)  \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0439 (Exchange Back End). \u042d\u0442\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 HTTP 500, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0439 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0434\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0432\u044b\u0434\u0430\u0447\u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430.\n\n\u0416\u0434\u0435\u043c \u043f\u0435\u0440\u0432\u044b\u0445 \u043b\u0430\u0441\u0442\u043e\u0447\u0435\u043a: \u043e\u0442 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u043b\u044e\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u043e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043f\u0440\u0435\u0440\u044b\u0432\u0438\u0441\u0442\u043e\u0439 \u043f\u043e\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u043e\u0439.", "creation_timestamp": "2021-08-31T12:01:17.000000Z"}, {"uuid": "d5bba683-ef68-4722-bffd-519482478466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cibsecurity/28015", "content": "\u274c Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping \u274c\n\nThe bug (CVE-2021-33766) is an information-disclosure issue that could reveal victims' personal information, sensitive company data and more.\n\n\ud83d\udcd6 Read\n\nvia \"Threat Post\".", "creation_timestamp": "2021-08-30T20:48:52.000000Z"}, {"uuid": "f1b37eeb-4b90-4c7f-b0ea-ca5ea8666e76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/thehackernews/1475", "content": "Unauthenticated attackers could exploit a new vulnerability \u2014 dubbed ProxyToken, CVE-2021-33766 \u2014 in Microsoft Exchange servers to change mailbox settings and spy on email.\n\nRead details: https://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html", "creation_timestamp": "2021-08-31T05:36:40.000000Z"}, {"uuid": "84950e06-b261-4dd3-93a1-3a04d4f84286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4189", "content": "#Threat_Research\n1. New Annke Vulnerability Shows Risks of IoT Security Camera Systems\nhttps://www.nozominetworks.com/blog/new-annke-vulnerability-shows-risks-of-iot-security-camera-systems\n2. ProxyToken:\nAn Authentication Bypass in Microsoft Exchange Server (CVE-2021-33766)\nhttps://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server", "creation_timestamp": "2021-09-01T05:02:52.000000Z"}, {"uuid": "0eec15fc-04b3-4a15-acd3-a1571543d962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4521", "content": "#exploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main", "creation_timestamp": "2021-10-15T11:07:01.000000Z"}, {"uuid": "efbbc40d-c913-49b9-8576-38c2454cffb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/18", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:14:31.000000Z"}, {"uuid": "39bb4226-aa24-4d0f-8da0-399ff6156c17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/19", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:15:23.000000Z"}, {"uuid": "d36b18e6-9d11-49d9-8aa3-a0e855129eca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/onelab1337/1252", "content": "ProxyToken CVE-2021-33766 Exploit\n\nhttps://www.scyllaforums.com/Thread-ProxyToken-CVE-2021-33766-Exploit", "creation_timestamp": "2026-08-09T05:02:33.264415Z"}, {"uuid": "49e78fdc-4ff8-4fe5-b79c-bd5351719f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/1252", "content": "ProxyToken CVE-2021-33766 Exploit\n\nhttps://www.scyllaforums.com/Thread-ProxyToken-CVE-2021-33766-Exploit", "creation_timestamp": "2026-08-10T00:00:10.525377Z"}, {"uuid": "e8863a8e-09b7-4864-9024-3b6d8db1c45e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2df41c72-639a-4e71-b507-b306553046ed", "content": "", "creation_timestamp": "2026-06-19T12:47:41.506299Z"}, {"uuid": "1a217b85-2033-45ff-b313-fa99c973897f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6e908940-de54-4953-8dd4-b5ca3fe06041", "content": "", "creation_timestamp": "2026-06-23T14:04:53.951993Z"}, {"uuid": "03a458fc-ecdb-4263-b97b-908a36e9e1fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msqouuyibk2r", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-33766: Microsoft Exchange Server Information Disclosure Vulnerability\nCVSS 7.3 \u00b7 EPSS 97.5% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2021-33766\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-10T18:06:13.989226Z"}, {"uuid": "f2187dcb-a14b-4693-8bdf-2fe2675078ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4621", "content": "Threat Research\n1. DOM XSS on Google com\nhttps://svennergr.github.io/writeups/google/ads_dom_xss1\n2. Abusing Slack\u2019s file-sharing functionality\nto de-anonymise fellow workspace members\nhttps://jub0bs.com/posts/2021-10-12-xsleak-stack\n\nOffensive security\nBypass Facebook SSL Pinning for iOS\nhttps://github.com/phwd/fb-ios-pinning-2021\n\nKernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL\nhttps://github.com/intel/kernel-fuzzer-for-xen-project\n\nBlue Team Techniques\n1. Sysmon For Linux\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\nSandbox Windows architecture\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nexploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\ud83d\ude01\nhttps://github.com/bhdresh CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-01T17:00:37.856979Z"}, {"uuid": "2ea73e2e-53a0-4072-b6ad-1e5ada499be8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4218", "content": "Unauthenticated attackers could exploit a new vulnerability \u2014 dubbed ProxyToken, CVE-2021-33766 \u2014 in Microsoft Exchange servers to change mailbox settings and spy on email.\nRead details: \nhttps://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html", "creation_timestamp": "2026-09-01T17:00:41.850192Z"}, {"uuid": "4146152b-3092-47a6-830d-15b4125c5b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4608", "content": "exploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nSandbox Windows architecture\ud83d\ude01\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nBlue Team Techniques\n1. Sysmon For Linux\ud83d\ude0a\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\n\n\u200e", "creation_timestamp": "2026-09-01T17:00:38.035688Z"}, {"uuid": "9a132cfa-11ab-420d-a5c5-e851a2cc0fbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:26.285749Z"}, {"uuid": "b2e32488-6931-49e0-976d-405f08de9dbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:59.876120Z"}, {"uuid": "ea5e6307-5c4f-4a16-8b2f-60ce683ff6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4218", "content": "Unauthenticated attackers could exploit a new vulnerability \u2014 dubbed ProxyToken, CVE-2021-33766 \u2014 in Microsoft Exchange servers to change mailbox settings and spy on email.\nRead details: \nhttps://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html", "creation_timestamp": "2026-09-02T01:04:28.300320Z"}, {"uuid": "3b2a572d-3cb4-4889-8116-73b26a6e8b04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4621", "content": "Threat Research\n1. DOM XSS on Google com\nhttps://svennergr.github.io/writeups/google/ads_dom_xss1\n2. Abusing Slack\u2019s file-sharing functionality\nto de-anonymise fellow workspace members\nhttps://jub0bs.com/posts/2021-10-12-xsleak-stack\n\nOffensive security\nBypass Facebook SSL Pinning for iOS\nhttps://github.com/phwd/fb-ios-pinning-2021\n\nKernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL\nhttps://github.com/intel/kernel-fuzzer-for-xen-project\n\nBlue Team Techniques\n1. Sysmon For Linux\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\nSandbox Windows architecture\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nexploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\ud83d\ude01\nhttps://github.com/bhdresh CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-02T01:04:22.704690Z"}, {"uuid": "17cabdab-a134-4637-8ec3-19c4bf5847b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4608", "content": "exploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nSandbox Windows architecture\ud83d\ude01\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nBlue Team Techniques\n1. Sysmon For Linux\ud83d\ude0a\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\n\n\u200e", "creation_timestamp": "2026-09-02T01:04:22.911808Z"}, {"uuid": "0f047885-03b2-4cc8-8194-0ed1e5f198e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "exploited", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T18:00:05.136533Z"}, {"uuid": "c3585938-b16f-4697-ac2c-2bb2d7b18be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "exploited", "source": "https://t.me/hacking_Attack/22094", "content": "Black Hat Ethical Hacking\nMicrosoft Exchange \u2018ProxyToken\u2019 Bug Allows Email Snooping\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange \u2018ProxyToken\u2019 Bug Allows Email SnoopingPost Views: 40 \nReading Time: 1 Minute\nA serious security vulnerability in Microsoft Exchange Server that researchers have dubbed ProxyToken could allow an unauthenticated attacker to access and steal emails from a target\u2019s mailbox.\nMicrosoft Exchange uses two websites; one, the front end, is what users connect to in order to access email. The second is a back-end site that handles the authentication function.\n\n\u201cThe front-end website is mostly just a proxy to the back end. To allow access that requires forms authentication, the front end serves pages such as /owa/auth/logon.aspx,\u201d according to a Monday posting on the bug from Trend Micro\u2019s Zero Day Initiative. \u201cFor all post-authentication requests, the front end\u2019s main role is to repackage the requests and proxy them to corresponding endpoints on the Exchange Back End site. It then collects the responses from the back end and forwards them to the client.\u201d\n\nThe issue arises specifically in a feature called \u201cDelegated Authentication,\u201d where the front end passes authentication requests directly to the back end. These requests contain a SecurityToken cookie that identify them; i.e., if the front end finds a non-empty cookie named SecurityToken, it delegates authentication to the back end. However, Exchange has to be specifically configured to have the back end perform the authentication checks; in a default configuration, the module responsible for that (the \u201cDelegatedAuthModule\u201d) isn\u2019t loaded.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cWhen the front end sees the SecurityToken cookie, it knows that the back end alone is responsible for authenticating this request,\u201d according to ZDI. \u201cMeanwhile, the back end is completely unaware that it needs to authenticate some incoming requests based upon the SecurityToken cookie, since the DelegatedAuthModule is not loaded in installations that have not been configured to use the special delegated authentication feature. The net result is that requests can sail through, without being subjected to authentication on either the front or back end.\u201d\n\nFrom there, attacker could install a forwarding rule allowing them to read the victim\u2019s incoming mail.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets \u201cWith this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users,\u201d according to the post. \u201cAs an illustration of the impact, this can be used to copy all emails addressed to a target and account and forward them to an account controlled by the attacker.\u201d\n\nZDI outlined an exploitation scenario wherein an attacker has an account on the same Exchange server as the victim. However, if an administrator permits forwarding rules having arbitrary internet destinations, no Exchange credentials are needed at all, researchers noted.\n\nThe bug (CVE-2021-33766) was reported to the Zero Day Initiative by researcher Le Xuan Tuyen of VNPT ISC, and it was patched by Microsoft in the July Exchange cumulative updates. Organizations should update their products to avoid compromise.\nSee Also: Offensive Security Tool: Starkiller The ProxyToken revelation comes after the disclosure of\u00a0ProxyLogon in early March; that\u2019s an exploit chain comprised of four Exchange flaws (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065), which together create a pre-authentication remote code execution (RCE) exploit. Attackers can take over unpatched servers without knowing [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:37.477908Z"}, {"uuid": "2f177491-263f-4aad-8463-18164b47b0a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4608", "content": "exploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nSandbox Windows architecture\ud83d\ude01\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nBlue Team Techniques\n1. Sysmon For Linux\ud83d\ude0a\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\n\n\u200e", "creation_timestamp": "2026-09-10T17:00:04.766632Z"}, {"uuid": "dadf13e8-082c-4d1a-bce6-5ddb83ad1819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4621", "content": "Threat Research\n1. DOM XSS on Google com\nhttps://svennergr.github.io/writeups/google/ads_dom_xss1\n2. Abusing Slack\u2019s file-sharing functionality\nto de-anonymise fellow workspace members\nhttps://jub0bs.com/posts/2021-10-12-xsleak-stack\n\nOffensive security\nBypass Facebook SSL Pinning for iOS\nhttps://github.com/phwd/fb-ios-pinning-2021\n\nKernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL\nhttps://github.com/intel/kernel-fuzzer-for-xen-project\n\nBlue Team Techniques\n1. Sysmon For Linux\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\nSandbox Windows architecture\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nexploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\ud83d\ude01\nhttps://github.com/bhdresh CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-10T17:00:05.003230Z"}, {"uuid": "134daf7b-b591-45e6-819b-67b763ea906a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4218", "content": "Unauthenticated attackers could exploit a new vulnerability \u2014 dubbed ProxyToken, CVE-2021-33766 \u2014 in Microsoft Exchange servers to change mailbox settings and spy on email.\nRead details: \nhttps://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html", "creation_timestamp": "2026-09-10T21:00:04.581028Z"}, {"uuid": "32aae0cc-c386-4deb-a5fe-a3f73e6cd2a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "seen", "source": "https://t.me/cissp/4218", "content": "Unauthenticated attackers could exploit a new vulnerability \u2014 dubbed ProxyToken, CVE-2021-33766 \u2014 in Microsoft Exchange servers to change mailbox settings and spy on email.\nRead details: \nhttps://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html", "creation_timestamp": "2026-09-11T00:00:11.910043Z"}, {"uuid": "acdd5cca-16bd-498c-8d5a-295e6c7b4545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4608", "content": "exploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nSandbox Windows architecture\ud83d\ude01\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nBlue Team Techniques\n1. Sysmon For Linux\ud83d\ude0a\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\n\n\u200e", "creation_timestamp": "2026-09-11T00:00:33.202750Z"}, {"uuid": "182d289d-cc56-4ace-8736-3fc5036a855a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33766", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4621", "content": "Threat Research\n1. DOM XSS on Google com\nhttps://svennergr.github.io/writeups/google/ads_dom_xss1\n2. Abusing Slack\u2019s file-sharing functionality\nto de-anonymise fellow workspace members\nhttps://jub0bs.com/posts/2021-10-12-xsleak-stack\n\nOffensive security\nBypass Facebook SSL Pinning for iOS\nhttps://github.com/phwd/fb-ios-pinning-2021\n\nKernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL\nhttps://github.com/intel/kernel-fuzzer-for-xen-project\n\nBlue Team Techniques\n1. Sysmon For Linux\nhttps://github.com/Sysinternals/SysmonForLinux\n]-> Automating the deployment of Sysmon for Linux/Azure Sentinel in a lab environment\nhttps://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054\n\nSandbox Windows architecture\nhttps://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md\n\nMalware analysis\n1. The Deimos implant\nhttps://www.elastic.co/blog/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant\n2. Necro Python Botnet\nGoes After Vulnerable VisualTools DVR\nhttps://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr\n\nexploit\n1. CVE-2021-33766:\nProxyToken - An Authentication Bypass in Microsoft Exchange Server PoC exploit\ud83d\ude01\nhttps://github.com/bhdresh CVE-2021-33766\n\n2. CVE-2021-38295:\nA simple Python PoC\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC/commits/main\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-11T00:00:33.405514Z"}]}