accounts_CVE-2024-40676-

This repository does not have a README...

DPAT

Herramienta de Auditoría de Contraseñas de Dominio DPAT DPAT es una herramienta de seguridad basada en Python que analiza hashes de contraseñas extraídos de controladores de dominio de Active Directory. Genera informes HTML completos que muestran estadísticas de uso de contraseñas, violaciones de...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

CVE-2021-3560-exploit

CVE-2021-3560 — Escalada de Privilegios en Polkit CVE-2021-3560 es una vulnerabilidad de escalada de privilegios local en Polkit anteriormente PolicyKit, el marco de autorización utilizado por los entornos de escritorio Linux. Un atacante local sin privilegios puede explotar una condición de...

Suborner

Suborner: El falsificador de cuentas invisible ¿Qué es esto? Un programa simple para crear una cuenta de Windows de la que solo tú sabrás : Crear cuentas locales invisibles sin net user ni aplicaciones de administración de usuarios del sistema operativo Windows por ejemplo, netapi32::netuseradd...

FakeDataGen

FakeDataGen es un generador completo de datos falsos válidos. Esta herramienta te ayuda a crear cuentas falsas en formato español con datos completamente válidos. Dentro de esta información, puedes encontrar los nombres más comunes, correos electrónicos, datos bancarios y otra información útil...

adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

CVE-2025-26318

TSplus Remote Access - CVE-2025-26318 Insecure Permissions Information Disclosure 📌 Description TSplus is, by default, vulnerable to the disclosure of information from users currently connected to the domain on TSplus. 🔍 Vulnerability Details CVE ID : CVE-2025-26318 Vendor : TSplus Affected...

solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. ============================================ | Collecting...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

CVE-2026-103282

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

TaskHound

Windows Privileged Scheduled Task Discovery Tool for fun and profit. TaskHound hunts for Windows scheduled tasks that run with privileged accounts and stored credentials. It enumerates tasks over SMB, parses XMLs, and identifies high-value attack opportunities through BloodHound integration. For...

CVE-2026-103282 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

APEX

APEX previously AzurePwn- Azure Post Exploitation Framework An attempt to ease up post ex tasks once we have access to some sort of credentials to an Azure related account. To be honest it is nothing new or spectacular. Just my old lazy ass doing some shortcuts so I don't need to remember all the...

BIT-RABBITMQ-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

Pikachu-SMTP

Pikachu-SMTP Fuerza bruta para usuarios de SMTP INSTRUCCIONES DE INSTALACIÓN $ git clone https://github.com/bloodbane0/Pikachu-SMTP.git $ cd Pikachu-SMTP $ ./pikachu Powershell-Pikachu $ .\pikachu.ps1...

CVE-2026-82829

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0...

hayat

Hayat Google Cloud Platform Script de auditoría y endurecimiento ¿Qué significa "Hayat"? Bueno, la verdad es que me costó encontrar un nombre único. "Hayat" es una palabra turca que significa "Vida" en inglés y también es el nombre de mi sobrina. ¿Listo para conocerla? 😍 😍 😍 Hayat es un script de...