13231 matches found
godehashed
Godehashed Ein Golang-Tool, das die dehashed.com-API verwendet, um nach kompromittierten Assets zu suchen. Die Ergebnisse können dann in eine CSV-Datei für die weitere Analyse zusammengestellt werden. Bildschirmfoto Dehashed API Du musst dem Tool einen API-Schlüssel zur Verfügung stellen. Siehe...
Computer-Security-Equifax-2017
Dépôt éducatif démontrant des vulnérabilités logicielles réelles : RCE Apache Struts2 CVE-2017-5638, exfiltration de données, chiffrement faible et stratégies d'atténuation assainissement, surveillance, bonnes pratiques de cryptographie. Démo équipe rouge contre équipe bleue des failles de sécuri...
cve-2017-5638
CVE-2017-5638 App demo di, sì, quella violazione di sicurezza del broker di dati. Include codice di exploit. Utilizzo base avvio root@kitploit: mvn jetty:run Quindi vai a http://localhost:8080/basic-struts/index.action. Dovresti vedere il messaggio Welcome to Struts 2!. Scansione delle...
buster
Beschreibung Buster ist ein fortschrittliches OSINT-Tool, das für folgende Zwecke verwendet wird: Soziale Konten einer E-Mail abrufen mithilfe mehrerer Quellen Gravatar, About.me, MySpace, Skype, GitHub, LinkedIn, frühere Datenlecks Links abrufen, wo die E-Mail gefunden wurde, mithilfe von Google...
CVE-2024-50961
Esposizione di Dati Sensibili CVE-2024-50961 Descrizione In DonWeb Ferozo Hosting v1.1, un attaccante remoto può sfruttare i parametri URL per accedere a dati sensibili, incluse le credenziali del database. I vettori d'attacco includono l'intercettazione di rete, i log del server e la cronologia...
Common-Vulnerability-and-Exploit
Common-Vulnerability-and-Exploit-5638 Questa è la vulnerabilità Apache Struts CVE-2017-5638 di struts 2. La stessa CVE che ha portato alla violazione del database di equifax. Un articolo su come applicare questo exploit e come difendersi tramite patch...
ZKTeco BioTime <= 9.0.1 - Privilege Escalation
BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...
RSVPMaker <= 9.2.5 - SQL Injection
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...
Dolibarr Unauthenticated Contacts Database Theft
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...
Mail Mint < 1.19.5 - Unauthenticated Email Disclosure
Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
WP Directory Kit plugin for WordPress = 1.4.9 contains a sensitive information exposure caused by improper access control in wdkpublicaction AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles. id: CVE-2025-13920 info: name: WP...
Contest Gallery - Broken Access Control
Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...
Jenkins <=2.196 - Cookie Exposure
Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
Credential-and-breach-monitoring
Comparaison des services d'exposition d'identité, de logs de voleurs et de fuites avec notation Ce document compare les services de renseignement sur les fuites, de surveillance du dark web et d'exposition d'identité selon des dimensions pratiques pertinentes pour les équipes de sécurité modernes...
pwndb
pwndb.py pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name. Usage root@kitploit: usage: pwndb.py -h --target TARGET --list LIST --output OUTPUT --proxy PROXY optional arguments: -h, --help show this help message and exit --target...
h8mail
h8mail è uno strumento di OSINT e di ricerca di violazioni di dati tramite email che utilizza diversi servizi di violazione e ricognizione, o archivi locali come la "Collection1" di Troy Hunt e il famigerato torrent "Breach Compilation". 📖 Indice Indice Funzionalità API Utilizzo Esempi di utilizz...
h8mail
h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...
steamer
Steamer Import, manage, search public dumps. Do you have massive amounts of CSV, .sql, .txt, that have credentials, passwords, and hashes inside? Use Steamer to manage them! Load them into a MongoDB database, and either use the console directly, or just use the handy web interface complete with...