WhatBreach

WhatBreach WhatBreach is an OSINT tool that simplifies the task of discovering what breaches an email address has been discovered in. WhatBreach provides a simple and effective way to search either multiple, or a single email address and discover all known breaches that this email has been seen i...

opensnitch

Join the project community on our server! OpenSnitch is a GNU/Linux application firewall. •• Key Features • Download • Installation • Usage examples • In the press •• Key features Interactive outbound connections filtering. Block ads, trackers or malware domains system wide. Ability to configure...

LeakSearch

LeakSearch LeakSearch is a simple tool to search and parse plain text passwords using ProxyNova COMB Combination Of Many Breaches over the Internet. You can define a custom proxy and you can also use your own password file, to search using different keywords: such as user, domain or password. In...

OneRuleToRuleThemStill

OneRuleToRuleThemStill An revamped and optimised version of OneRuleToRuleThemAll. OneRuleToRuleThemStill now has a 5% 6.9% reduction in rules 52,000 down to 49,465 48,414 with 0% performance loss against the Lifeboat and LastFM data breaches. Updates: De-duplication of resulting candidate...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

MailAccess

Let's connect mailaccess.pro · Docs · PyPI · Changelog Self-hostable OSINT platform for investigating email addresses. Fan out across breach databases, social networks, DNS records, and the open web, then get back a unified exposure score and structured findings you can export or pipe into Malteg...

XposedOrNot

XposedOrNot XposedOrNot XoN tool is to search an aggregated repository of xposed passwords comprising of 850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security. Screenshot What is Xposed Passwords? The main aim of this project is to give...

Breach-Report-Collection

Breach Report Collection A collection of companies that disclose adversary TTPs after they have been breached Useful for analysis of intrusions launched by adversaries with measurable effects and impact Organization| Breach Date| Adversary| Source ---|---|---|--- DigiCert| April 2026| GoldenEyeDo...

pwnedOrNot

OSINT Tool for Finding Passwords of Compromised Email Accounts Created by Lohitya Pushkar thewhiteh4t. Twitter - Blog Available| in| ---|---|--- BlackArch Linux| SecBSD| Tsurugi Linux | | pwnedOrNot works in two phases. In the first phase it tests the given email address using HaveIBeenPwned v3...

iKy

Description | Installation | Website | Modules | Issues | Supporting iKy Description Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Video Demo Modules Installation You must install Redis and start it...

Zen

Find email addresses of Github users Find email address of a user python zen.py username or python zen.py https://github.com/username Find email addressess of contributors of a repository python zen.py https://github.com/username/repository Find email addresses of members of an organization pytho...

rupture

Rupture Rupture is a framework for easily conducting BREACH and other compression-based attacks. Authors Rupture is developed by: Dimitris Karakostas [email protected] Dionysis Zindros [email protected] Eva Sarafianou [email protected] Dimitris Grigoriou [email protected] This...

Computer-Security-Equifax-2017

Educational repo demonstrating real-world software vulnerabilities: Apache Struts2 CVE-2017-5638 RCE, data exfiltration, weak encryption, and mitigation strategies sanitization, monitoring, crypto best practices. Red team vs blue team demo of OS security flaws: exploit, persistence backdoor, and...

Password-Strength-Evaluator

Password Strength Evaluator Password Strength Evaluator is a tool to evaluate the strength of passwords and provide recommendations to improve their security. This tool also checks if your password has been exposed in any data breaches using the Have I Been Pwned API. Additionally, it stores the...

steamer

Steamer Import, manage, search public dumps. Do you have massive amounts of CSV, .sql, .txt, that have credentials, passwords, and hashes inside? Use Steamer to manage them! Load them into a MongoDB database, and either use the console directly, or just use the handy web interface complete with...

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

Contest Gallery - Broken Access Control

Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...