seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

whatsapp-census

¡Hola! Estás usando WhatsApp Este es el repositorio de GitHub para la versión extendida del artículo ¡Hola! Estás usando WhatsApp: Enumerando tres mil millones de cuentas para la seguridad y privacidad. Resumen WhatsApp, con 3.5 mil millones de cuentas activas a principios de 2025, es la platafor...

blackbird

Blackbird Una herramienta OSINT para buscar rápidamente cuentas por nombre de usuario en 574 sitios. El Lockheed SR-71 "Blackbird" es un avión de reconocimiento estratégico de gran altitud, largo alcance y Mach 3+ desarrollado y fabricado por la empresa aeroespacial estadounidense Lockheed...

email-osint-ripper

email-osint-ripper EO-RIPPER.PY es una herramienta perfecta para hacer OSINT a un email o una lista de emails. Sus funcionalidades son diversas y nos permiten obtener mucha información sobre nuestro objetivo. Vídeos https://www.youtube.com/watch?v=Eo9mJLBc2c&t=254s...

s3-account-search

S3 账户搜索 此工具允许你查找某个 S3 存储桶所属的账户 ID。 要使此功能生效，你至少需要具备以下权限之一： 从存储桶下载已知文件的权限（s3:getObject）。 列出存储桶内容的权限（s3:ListBucket）。 此外，你需要一个可以代入的角色，该角色对你正在检查的存储桶拥有（其中一项）这些权限。 更多背景信息可参见 Cloudar 博客 安装 该软件包可在 pypi 上获取，你可以使用以下命令之一（推荐使用 pipx） pipx install s3-account-search pip install s3-account-search 使用示例 使用存储桶...

Stalker

Qué es Stalker Una herramienta OSINT muy simple y probablemente mal escrita que te permitirá buscar rápidamente un solo nombre de usuario en varios sitios web. Su objetivo es ahorrar tiempo y quería mantenerlo simple, así que todo está en un único archivo .py desordenado. Pronto trabajaré en eso...

CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

EUVD-2025-210911

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166

WSO2 Identity Server is affected by a username enumeration vulnerability in its SMS OTP flow . The root cause is that the OTP initiation process returns differing error messages depending on whether the queried account exists and has a mobile number configured, allowing an attacker to infer valid...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

PT-2026-57844

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and...

Devolutions Server <= 2026.1.21 / 2026.2.0 <= 2026.2.5 Multiple Vulnerabilities (DEVO-2026-0017)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.21 or 2026.2.0 prior or equal to 2026.2.5. It is, therefore, affected by multiple vulnerabilities, including: - Improper access control in PAM account discovery results in Devolutions Server 2026.2.5,...