seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

Stalker

What's Stalker Very simple and probably badly written OSINT tool that will allow you to quickly search through several websites for a single username. It's aimed to save time and I wanted to keep it simple, so everything's in one single, messy .py file. I'll soon work on that to clean all of this...

blackbird

Blackbird An OSINT tool to search fast for accounts by username across 574 sites. The Lockheed SR-71 "Blackbird" is a long-range, high-altitude, Mach 3+ strategic reconnaissance aircraft developed and manufactured by the American aerospace company Lockheed Corporation. Disclaimer This or previous...

email-osint-ripper

email-osint-ripper EO-RIPPER.PY is a perfect tool for doing OSINT on an email or a list of emails. Its functionalities are diverse and allow us to obtain a lot of information about our target. Videos https://www.youtube.com/watch?v=Eo9mJLBc2c&t=254s...

CVE-2024-2323 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...

CVE-2024-2323

The RemoteUserStoreManagerService in multiple WSO2 products fails to sufficiently validate password change attempts when the password history validation feature is active. This security oversight allows an attacker to perform brute force attacks to discover user passwords without adequate restric...

CVE-2025-13591

The authentication endpoint of WSO2 Identity Server is vulnerable to username enumeration because it produces inconsistent system responses when an invalid username is submitted. Attackers can exploit this observable discrepancy to identify valid user accounts within the system. Successful enumer...

CVE-2025-13591 Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user account...

whatsapp-census

Hey there! You are using WhatsApp This is the github repository for the extended version of the paper Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy. Abstract WhatsApp, with 3.5 billion active accounts as of early 2025, is the world's largest instan...

s3-account-search

S3 Account Search This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you...

CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

EUVD-2025-210911

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166

WSO2 Identity Server is affected by a username enumeration vulnerability in its SMS OTP flow . The root cause is that the OTP initiation process returns differing error messages depending on whether the queried account exists and has a mobile number configured, allowing an attacker to infer valid...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...