squarephish

SquarePhish SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes. See PhishInSuits for more details on using OAuth Device Code flow for phishing attacks. / | | | | | | | | | | | | | \ \ / | | | |/ | '/ \ /| ' | / | ' \ | |...

fail2ban

/ | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system firewall rules to...

CVE-2026-91896

Dell Alienware Command Center (AWCC) , versions prior to 6.14.54.0 , is vulnerable to an Authentication Bypass by Spoofing (CWE-290). A low privileged attacker with local access can exploit this flaw to cause Information Tampering , Denial of Service , and Spoofing of Application Notifications . ...

CVE-2026-116769

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers affecting versions 13.0 and prior to 14.61 . The flaw allows an attacker to modify the security settings of a client through the server. No specific root cause details, exploit links, or remediation steps are provi...

Bastillion

Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal — once a host is registered, authoriz...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

phishery

phishery Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document. The power of phishery is best demonstrated by setting a Word document's template...

authz0

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers...

LDAPPER

Introduction This tool was written to address a lot of the issues I was experiencing with ldapsearch and AD interaction in general. In particular, this tool addresses the following problems that I've experienced: 1. Inability to return more than a thousand results from AD. This tool supports LDAP...

ssh-tpm-agent

SSH agent for TPM ssh-tpm-agent is a ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module TPM for authentication towards ssh servers. TPM sealed keys are private keys created inside the Trusted Platform Module TPM and sealed in .tpm suffixed files. They are bou...

CVE-2026-119731

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

ADTrapper

ADTrapper - Active Directory Security Analysis Platform Professional Active Directory Security Analysis and Threat Detection Platform Transform Windows authentication logs into actionable security insights with advanced threat detection and interactive visualizations Overview ADTrapper is a...

CVE-2024-55591

FortiGate CVE-2024-55591 1Scan Latest Version https://github.com/0x7556/1Scan Affected Versions FortiOS 7.0.0 through 7.0.16 FortiProxy 7.0.0 through 7.0.19 FortiProxy 7.2.0 through 7.2.12 POC Single Detection ./poc 10.10.1.1 ./poc http://10.10.1.1 1Scan Batch ./1scan 10.10.1.1 ./1scan 10.10.1.1/...

ssh-mitm

SSH-MITM - ssh audits made simple An interactive SSH interception tool for authorized security audits. Intercept sessions, monitor live traffic, inject commands, and manipulate file transfers — all in real time. !Follow me on...

tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

about-hmac

About HMAC An Example Implementation of Basic HMAC Hash-based Message Authentication Code Using Flask in Python. What is HMAC?! Hash-based message authentication code HMAC provides the server and the client each with a private key that is known only to that specific server and that specific clien...