1578 matches found
SocialFish
SocialFish v3.0 Modern Dynamic Phishing Toolkit SocialFish v3.0 brings powerful new features for cloning modern login pages, capturing cookies, and intercepting 2FA codes with a live operator panel. π What's New in v3.0 Playwright Browser Automation β Clone modern JS-heavy login pages Full Cookie...
wordpress-cve-2024-10924-exploit
WordPress CVE-2024-10924 Exploit π Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication 2FA. Attackers can exploit this flaw to log in as any user with a valid...
Session-Persistence-After-Enabling-2FA-CVE-2025-60425
Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...
Bastillion
Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems β like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal β once a host is registered, authoriz...
Modlishka
..Modlishka.. Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a sing...
WordPress Defender Security plugin < 6.4.1 - 2FA Bypass vulnerability
2FA Bypass vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Defender Security versions 6.4.1...
CVE-2026-119040 Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor...
CVE-2026-119040
The Defender Security WordPress plugin version before 6.4.1 is vulnerable to a two-factor authentication (2FA) bypass. The root cause is that the plugin's default configuration does not limit the number of failed 2FA attempts. This allows an attacker who already possesses a victim's password to b...
thief_raccoon
Thief Raccoon - Login Phishing Tool Thief Raccoon is a tool designed for educational purposes to demonstrate how phishing attacks can be conducted on various operating systems. This tool is intended to raise awareness about cybersecurity threats and help users understand the importance of securit...
SMSOTPBOT
ghost-OTPBOT ghost-OTPBOT is the most advanced and versatile OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank. You can use this to get OTP for logins, banks, credit cards, apple pay, and more. Join...
CredSniper
CredSniper Overview Benefits Basic Usage Installation Screenshots Gmail Module Maintainer Contributing Overview Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured...
CVE-2026-126731
This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. Under certain circumstances, an attacker can make the module treat a login as having passed the password check when it did not, or reach the two-factor set...
CVE-2026-126730
This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. The module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA for...
evilTrust
evilTrust Ideal tool for automated deployment of a Rogue AP with template selection + 2FA capability. This tool has several templates to use, including a custom template option, where the attacker can deploy their own template. IMPORTANT : No wired connection is required, so the attack can be...
EvilnoVNC
EvilnoVNC EvilnoVNC is a Ready to go Phishing Platform. Unlike other phishing techniques, EvilnoVNC allows 2FA bypassing by using a real browser over a noVNC connection. In addition, this tool allows us to see in real time all of the victim's actions, access to their downloaded files and the enti...
DRUPAL-CONTRIB-2026-322
This module enables you to require a second authentication factor a time-based one-time password from an authenticator app when users log in. Under certain circumstances, an attacker can make the module treat a login as having passed the password check when it did not, or reach the two-factor set...
wordpress-cve-2024-10924-pentest
WordPress CVE-2024-10924 Penetration Testing Report 2FA Bypass Vulnerability in Really Simple SSL Plugin π Table of Contents Executive Summary Target Information Methodology Timeline Reconnaissance Phase Vulnerability Analysis Attack Flow Exploitation Impact Assessment Remediation Tools Used...
desktop-2fa
π‘οΈ Desktop-2FA A secure, offline two-factor authentication 2FA manager for desktop environments. Built with Python, featuring strong encryption and no cloud dependencies. π Landing Page : desktop-2fa.org β¨ Features Feature| Description ---|--- π Vault Security| AES-256-GCM encryption with Argon2id...
0-click-RCE-Exploit-for-CVE-2024-10924
CVE-2024-10924 / Auth Bypass 2FA to RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859061671852909055 This repository contains a proof-of-concept exploit for CVE-2024-10924, an authentication and 2FA bypass vulnerability in the Really Simple Security WordPress plugin tha...
PMA-5.2.3-WebAuthn-2FA
abraxaslabs.tech Β· github.com/abraxas Β· @abraxasnull Β· [email protected] Β· PMA-5.2.3-WebAuthn-2FA PMA-5.2.3-WebAuthn-2FA phpMyAdmin 5.2.3 - phpMyAdmin Default tarball. web-auth/webauthn-lib is suggest / require-dev. composer install --no-dev does not install it. createServer therefore uses...