CVE-2026-51954

Product: Webasyst Framework Affected Version: ≤ 4.0.3 Severity: High CVSS 3.1: 8.0 Description Webasyst Framework through 4.0.3 contains an OAuth 2.0 implementation flaw that allows a remote, unauthenticated attacker to intercept authorization credentials issued during the OAuth flow, without...

askWAM

askWAM askWAM solicita tokens de acceso de Microsoft Entra de forma silenciosa a través del Administrador de cuentas web de Windows WAM. Se distribuye como un cliente de .NET Framework, un cliente nativo x64 independiente y un Beacon Object File x64 con un adaptador de comandos CNA. Todos los...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

shhgit

🚨 shhgit is no longer maintained. If you need support or consultation for your secret scanning endeavours, drop me an e-mail [email protected] 🚨 shhgit helps secure forward-thinking development, operations, and security teams by finding secrets across their code before it leads to a security...

trajan

Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan parses workflow YAML files, builds dependency graphs, runs...

TokenUniverse

Token Universe Token Universe 是一个用于实验和研究 Windows 安全机制 的高级工具。它提供了创建、查看、模拟和修改访问令牌、生成进程、管理本地安全机构、检查可用访问权限以及修改多种对象的安全设置等功能的用户界面。该程序可以在多种权限级别下运行并（至少部分地）提供有价值的功能，从 LPAC AppContainer 沙箱到具有 SeTcbPrivilege 和 SeCreateTokenPrivilege 的 SYSTEM。 下载 该工具支持 Windows 7 及以上版本。请参阅 发行版 页面获取预编译的二进制文件。...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and...

SlackPirate

SlackPirate - Slack 枚举与提取工具 这是一款使用 Python 开发的工具，它利用 Slack 原生 API 在给定访问令牌的情况下，从 Slack 工作区中提取“有趣”的信息。 截至 2018 年 5 月，Slack 拥有超过 800 万用户，并且这一数字正在迅速增长——其集成和“ChatOps”的可能性是无限的，允许团队（不仅仅是开发者！）创建一些非常强大的工作流以及 Slack 机器人/应用程序交互。 与大大小小的企业一样，Slack 这类工具经常被信息安全管理/策略雷达所忽视，这最终导致敏感和机密信息出现在它们不应出现的地方，从而引发危险情况。...

Microsoft365_devicePhish

Microsoft365devicePhish 滥用 Microsoft 365 OAuth 授权流程进行钓鱼攻击 这是一个简单的概念验证脚本，允许攻击者针对 Microsoft 365 OAuth 授权流程实施钓鱼攻击。利用此脚本，攻击者可连接 Microsoft 的 OAuth API 端点，生成 usercode 和 devicecode，并在成功的钓鱼攻击后获取受害用户的 accesstoken。随后，该令牌可用于通过 Microsoft Graph API 代表受害用户访问各种 Office365 产品。此外，此脚本专为解决特定场景而设计：目标组织使用邮箱...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

AzureRT

AzureRT Módulo de Powershell que implementa varios cmdlets para interactuar con Azure y Azure AD desde una perspectiva ofensiva. Utilidades útiles que manejan autenticación basada en tokens de acceso, cambio entre interfaces Az a AzureAD y az cli, ataques predefinidos fáciles de usar como ejecuci...

remote-control

Remote Control for Laravel Grant remote access to user account without sharing credentials. Installation Configuration Usages Routing Creating Remote Access Using Generated Access Token Installation Remote Control can be installed via composer: root@kitploit: composer require...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

TokenTactics

TokenTactics Azure JSON Web Token "JWT" 操纵工具集 Azure 访问令牌允许你以通过设备代码登录的用户身份向特定端点进行身份验证。即使他们使用了多因素身份验证。一旦你获得了用户的访问令牌，就有可能访问某些应用，例如 Outlook、SharePoint、OneDrive、MSTeams 等。 例如，如果你拥有 Graph 或 MSGraph 令牌，就可以连接到 Azure 并导出用户、组等。然后，根据条件访问策略，可以切换到 Azure Core Management 令牌并运行 AzureHound。接着，切换到 Outlook...

EUVD-2026-76850

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

gcat

Gcat A stealthy Python based backdoor that uses Gmail as a command and control server This project was inspired by the original PoC code from Benjamin Donnelly This is PoC code... ... that was released for orginazations to test their defenses against these type of attacks. In order to detect them...