redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

EUVD-2026-96616

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

EUVD-2026-96601

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

EUVD-2026-96554

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

BadBlood

BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an...

telegram-nearby-map

Telegram Nearby Map Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map...

CVE-2026-108662

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the /sys/tenant/deleteTenantPackUser endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by supplying arbitrary userId and packId values in a PUT re...

turkce-wordlist

This project does not contain any personal data such as email addresses, names, phone numbers. Passwords are listed only for academic purposes. It is not possible to associate passwords with real people. Turkish Wordlist This is a study conducted for the analysis of password choices of Turkish...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

EUVD-2026-96401

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

simplewall

simplewall بالتأكيد للمستخدمين المتقدمين. الوصف: أداة بسيطة لتكوين منصة تصفية ويندوز WFP والتي يمكنها تكوين النشاط الشبكي على جهاز الكمبيوتر الخاص بك. التطبيق خفيف الوزن أقل من ميغابايت، وهو متوافق مع ويندوز 7 SP1 وأنظمة التشغيل الأحدث. يمكنك تنزيل إما النسخة القابلة للتثبيت أو المحمولة. للعمل بش...

SocialPath

SocialPath Track users across social media platforms Deanonymizing darknet users by username reuse Research no. 2 in progress Supported services: Facebook Twitter + details Stackoverflow + details Instagram + details Reddit + details Steam Pinterest Tumblr Pastebin Github Requirements: Django...

CVE-2026-3629

CVE-2026-3629 - مدقق تصعيد الامتيازات في ووردبريس أداة سطر أوامر للكشف عن CVE-2026-3629 ، وهي ثغرة حرجة لتصعيد الامتيازات في إضافة ووردبريس "استيراد وتصدير المستخدمين والعملاء". 📢 انضم إلى مجتمعنا ابقَ على اطلاع بأحدث الأدوات الأمنية والثغرات وتقنيات الاختراق! لماذا الانضمام؟ ✅ أحدث تحديثات CVE ✅...

CVE-2021-24006

CVE-2021-24006 – استغلال تحكم الوصول غير الصحيح في FortiManager PoC PoC Proof of Concept - للأغراض التعليمية فقط استغلال الوصول غير المصرح به إلى SD-WAN Orchestrator في FortiManager، من خلال استغلال ثغرة التحكم في الوصول CWE-284. الوصف تؤثر الثغرة CVE-2021-24006 على FortiManager الإصدارات 6.4.0 ح...

sudo-snooper

sudo-snooper sudo-snooper acts like the original sudo binary to fool users into entering their passwords. It will show a fake prompt just like the original to the user to enter their sudo password. This can be useful in penetration tests or security evaluations for testing user knowledge...

kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

CVE-2021-24959

CVE-2021-24959 الوصف إضافة WP Email Users لووردبريس حتى الإصدار 1.7.6 لا تقوم بتعقيم المعامل dataraw في إجراء AJAX weuselectedusers1، المتاح لأي مستخدمين مصادقين، مما يسمح لهم بتنفيذ هجمات حقن SQL. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published January 31, 2022 Last Updated January 22, 2024...

httptoolkit

HTTP Toolkit !HTTP Toolkit has received funding from NLnet as part of NGI Zero...

john

John the Ripper This is the community-enhanced, "jumbo" version of John the Ripper. It has a lot of code, documentation, and data contributed by jumbo developers and the user community. It is easy for new code to be added to jumbo, and the quality requirements are low, although lately we've start...