NfSpy

NfSpy - an ID-spoofing NFS client by Daniel Miller NfSpy is a Python library for automating the falsification of NFS credentials when mounting an NFS share. Included are two client programs: nfspy uses the Filesystem in Userspace FUSE library to mount an NFS share in Linux. This allows the use of...

CVE-2023-25136

CVE-2023-25136 OpenSSH 9.1 Vulnerability Mass Scanning and Exploitation Vulnerability Details OpenSSH is software that implements the SSH protocol, commonly used to securely connect to Linux or Windows machines for remote administration. The CVE-2023-25136 security vulnerability introduced in...

tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

sherloq

An open source digital image forensic toolset Introduction "Forensic Image Analysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement...

CVE-2024-27198-RCE

Cyberspace Mapping Dork Fofa app="JETBRAINS-TeamCity" ZoomEye app:"JetBrains TeamCity" Hunter.how product.name="TeamCity" Shodan http.component:"teamcity" How to use I'm using Python3.9. pip install requests urllib3 faker python CVE-2024-27198-RCE.py -t http://192.168.198.173:8111 --behinder4...

CVE-2025-68404 vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface

A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...

CVE-2025-68404

The software QuRouter is affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability (CWE-367). If successfully exploited, a remote attacker could compromise the security of the system. The vulnerability has been addressed in QuRouter 2.6.4.001 and subsequent versions. No specif...

CVE-2026-16232

CVE-2026-16232 Overview A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token. This affects Check Point Security Management Server and Multi-Domain Security Management Server MDS. For a full technical analysis,...

CVE-2026-107350

A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...

OpenAM

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...

yasuo

YASUO @0xsauby Description Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise th...

Zabbix-CVE-2022-23131

Zabbix-CVE-2022-23131 Zabbix-SAML-Bypass: CVE-2022-23131 Description: Zabbix is vulnerable to Frontend Authentication Bypass Vulnerability with enabled SAML SSO authentication, due to insecure client-side session storage. On successful exploit of this issue, it allows a malicious actor to escalat...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2021-27651

CVE-2021-27651 Pega Infinity Password Reset Video Follow Youtube Twitter Telegram Vulnmachines.com...

BlackBerryC2

BlackBerryC2 2.0.0-beta BlackBerryC2 is an encrypted remote administration and C2 framework designed exclusively for educational use, security research, and controlled laboratory environments. The project demonstrates how to build a custom command-and-control server with application-layer...

fortigate-cve-2022-40684-tool

Description This tool allows security professionals to identify and validate exposure to CVE-2022-40684 in FortiGate devices by interacting with exposed CMDB API endpoints. It supports enumeration of administrative users, user groups, and selective configuration extraction for analysis in...

CVE-2021-44270

CVE-2021-44270 Anviz-Access-Control-Authentication-Bypass https://nvd.nist.gov/vuln/detail/CVE-2021-44270...

CVE-2015-7755-POC

CVE-2015-7755-POC CVE-2015-7755 vulnerability detection using ssh to connect those vulnerable version: ScreenOS 6.2.0r15—6.2.0r18，6.3.0r12—6.3.0r20 Juniper Networks user: root passwd: %sun='%s' = %u...

Autorize

Autorize Autorize is an open-source automatic authorization and authentication enforcement detection extension for Burp Suite. It is designed to assist application security engineers and penetration testers in identifying authorization bypasses and authentication weaknesses in web applications—at...