iPwn

iPwn Un framework diseñado para la explotación de dispositivos iOS. RECUERDA: EL IPHONE AL QUE INTENTAS ACCEDER CON ESTA HERRAMIENTA DEBE ESTAR HACKEADO JAILBROKEN Estado - ❌ Este proyecto aún está en desarrollo. Estoy agregando más extensiones y opciones para post-explotación con el fin de...

monsoon

monsoon Un rápido enumerador HTTP que te permite ejecutar un gran número de solicitudes HTTP, filtrar las respuestas y mostrarlas en tiempo real monsoon es un fuzzer HTTP rápido y flexible que se puede utilizar para una amplia variedad de acciones, desde descubrimiento de contenido hasta fuerza...

domainim

DOMAINIM Features • Usage • Installation • Usage • Contributing • Additional Notes Domainim is a fast domain reconnaissance tool for organizational network scanning. The tool aims to provide a brief overview of an organization's structure using techniques like OSINT, bruteforcing, DNS resolving...

altdns

Altdns - Subdomain discovery through alterations and permutations Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain such as test, dev, staging as well as takes in a list of...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

dnsbrute

dnsbrute Fuerza bruta DNS multihilo, velocidad media de 80 consultas/segundo con 40 hilos Uso: dnsbrute.py threads...

BruteConda

Si esto te ha ayudado, quizás puedas ayudarme patrocinándome, lo que me ayudará a crear mejores "herramientas de código abierto" BruteConda ¡Una herramienta de fuerza bruta de directorios que hace tu vida más fácil! ¿Por qué solo BruteConda? Rápida y eficiente Fácil de usar Amigable con el usuari...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

kerbrute

Kerbrute A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication Grab the latest binaries from the releases page to get started. Background This tool grew out of some bash scripts I wrote a few years ago to perform bruteforcing using the...

ffufw

ffufw ffuf con esa salsa especial Instalación go install github.com/puzzlepeaches/ffufw@latest ¿Por qué? ffufw es un envoltorio de ffuf que hace que el ataque de fuerza bruta a directorios sea más fácil e inteligente. La herramienta tiene las siguientes características: Ejecución multihilo de...

HMAC_Bruteforcer

HMACBruteforcer Very Slow HMAC Key Bruteforcer Implemented in Bash Uses: OpenSSL Crunch Optional...

EUVD-2022-42454

Malicious code in bioql PyPI...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login plugin (versions before 8.4.6.1 ) is vulnerable to an authentication bypass because it fails to implement rate limiting on OTP validation attempts. This flaw allows unauthenticated attackers to perform bruteforce attacks to guess SMS OTP values...

U.S. Dept Of Defense: Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

The website had a directory that lacked authentication, allowing an attacker to add a new admin user and change the privileges of existing users without any authentication...

CVE-2023-49259 Bruteforcing authentication cookie for a given user

The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...

The Rising Diicot Threat Group with Diverse Attack Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Romanian threat group “Diicot” has been actively employing SSH bruteforcing and deploying malware loaders to compromise systems for the purpose of cryptocurrency mining. The campaign involves exploitin...

Improper Authentication

calibreweb is vulnerable to Improper Authentication. The vulnerability exists in the login function of web.py file, which allows a remote attacker to takeover the account by bruteforcing due to improper restriction of excessive authentication attempts...

TikTok: bypass two-factor authentication in Android apps and web

A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password...