seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

Stalker

Qué es Stalker Una herramienta OSINT muy simple y probablemente mal escrita que te permitirá buscar rápidamente un solo nombre de usuario en varios sitios web. Su objetivo es ahorrar tiempo y quería mantenerlo simple, así que todo está en un único archivo .py desordenado. Pronto trabajaré en eso...

blackbird

Blackbird 一款用于在574个网站中快速通过用户名搜索账户的OSINT工具。 洛克希德SR-71“黑鸟”是一款由美国航空航天公司洛克希德公司研制和生产的高空高速战略侦察机，航程远，速度可达3马赫以上。 免责声明 本程序及其先前版本仅供教育用途。未经许可不得使用。 通常的免责声明同样适用，尤其是我（P1ngul1n0）不对因直接或间接使用这些程序提供的信息或功能而造成的任何损失负责。 作者或任何互联网提供商对这些程序或其任何衍生品的内容或滥用不承担任何责任。使用这些程序即表示您接受：因使用这些程序造成的任何损失（数据丢失、系统崩溃、系统入侵等）均非P1ngul1n0的责任。 设置...

whatsapp-census

¡Hola! Estás usando WhatsApp Este es el repositorio de GitHub para la versión extendida del artículo ¡Hola! Estás usando WhatsApp: Enumerando tres mil millones de cuentas para la seguridad y privacidad. Resumen WhatsApp, con 3.5 mil millones de cuentas activas a principios de 2025, es la platafor...

s3-account-search

S3 账户搜索 此工具允许你查找某个 S3 存储桶所属的账户 ID。 要使此功能生效，你至少需要具备以下权限之一： 从存储桶下载已知文件的权限（s3:getObject）。 列出存储桶内容的权限（s3:ListBucket）。 此外，你需要一个可以代入的角色，该角色对你正在检查的存储桶拥有（其中一项）这些权限。 更多背景信息可参见 Cloudar 博客 安装 该软件包可在 pypi 上获取，你可以使用以下命令之一（推荐使用 pipx） pipx install s3-account-search pip install s3-account-search 使用示例 使用存储桶...

email-osint-ripper

email-osint-ripper EO-RIPPER.PY 是一个用于对单个邮箱或邮箱列表进行 OSINT 的完美工具。其功能多样，使我们能够获取关于目标的许多信息。 视频 https://www.youtube.com/watch?v=Eo9mJLBc2c&t=254s https://www.youtube.com/watch?v=0lJ6iD2x72o&t=144s 如何使用 EO-RIPPER？ 推荐使用 Linux 操作系统，不过仅需要 Python 3 和以下库： 库 re, json, cookielib Mechanize - "pip3 install...

CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

EUVD-2025-210911

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166

WSO2 Identity Server is affected by a username enumeration vulnerability in its SMS OTP flow . The root cause is that the OTP initiation process returns differing error messages depending on whether the queried account exists and has a mobile number configured, allowing an attacker to infer valid...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

PT-2026-57844

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and...

Devolutions Server <= 2026.1.21 / 2026.2.0 <= 2026.2.5 Multiple Vulnerabilities (DEVO-2026-0017)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.21 or 2026.2.0 prior or equal to 2026.2.5. It is, therefore, affected by multiple vulnerabilities, including: - Improper access control in PAM account discovery results in Devolutions Server 2026.2.5,...