xmlrpc-brute

WordPress XML-RPC Bruteforce Tool A tool designed to test WordPress sites for XML-RPC vulnerabilities by attempting to brute force user credentials through the XML-RPC interface. Description This tool tests WordPress installations for XML-RPC authentication vulnerabilities. It can perform standar...

detect_bruteforce

detectbruteforce...

cisco-SNMP-enumeration

Cisc0wn - Cisco SNMP 脚本 Cisco SNMP 枚举、暴力破解、配置下载和密码破解脚本。 针对 Cisco IOS 交换机和路由器设计并测试。 由 NCC Group Plc 以开源方式发布 - http://www.nccgroup.com/ 由 Daniel Compton 开发，daniel dot compton at nccgroup dot com 由 Tom Watson 修复并更新，tom dot watson at nccgroup dot com 由 Darren McDonald 做小幅提交，darren dot mcdonald at...

creep-web-app-scanner

creep-web-app-scanner 一个（非常）简陋的网站扫描器，目前由一名 NCC Group 员工兼大学毕业生利用 20% 的研究时间开发。creep 目前会爬取网站，并在每个页面中搜索潜在有价值的信息。 creep 将爬取你的（仅 HTTP）目标，并提取网站上有趣的信息，包括： 源代码注释 错误（MySQL 错误、警告、致命错误等） Linux 文件路径 creep 还将在现有已知位置执行文件/目录爆破，以尝试定位可能有趣的文件/目录（例如 test.php、admin/ 等）。 creep...

buffalo

Buffalo 一个 Python 3 脚本，使用两个文本文件作为输入，对目标 SSH 服务器执行字典/词表攻击。此脚本的编写目的是为了我的 Intel 技术筛选。 安装 此脚本依赖于 Paramiko 和 Colorama。 通过 pip install -r requirements.txt 或 pip3 install -r requirements.txt 安装依赖。 用法 默认设置 端口 22，无尝试次数限制，也无锁定时间 python3 buffalo.py localhost users.txt passwords.txt 更高的线程数 默认线程数为 100 ，可以使用...

CacheData_decrypt

CacheDatadecrypt Un simple kit de herramientas para hacer fuerza bruta y descifrar el CacheData de Windows EntraId. root@kitploit: usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as...

HQLmap

HQLMap 本项目旨在利用HQL注入漏洞。 该工具使用Python编写，并在MIT许可证下发布。 未来开发：我计划为SQLmap开发专用模块。 在哪里可以尝试该工具？ 如果你想要一个快速易受攻击的环境来尝试该工具，我推荐使用RopeyTasks： https://github.com/continuumsecurity/RopeyTasks/ 此外，如果你想要更多关于HQLi的信息，请查看这篇博客文章： http://blog.h3xstream.com/2014/02/hql-for-pentesters.html 安装 要安装此项目，只需通过以下命令克隆该项目：...

awind-research

Awind 研究 本仓库收录了与我所开展的研究相关的各类有用资料，该研究针对 Awindinc 制造并贴牌（OEM）给多家厂商的无线演示设备。 该仓库分为以下几个子部分： hardware - 硬件破解相关内容，主要用于 MMC 转储和引脚定义文档 networking - PIN 码暴力破解器、自定义 Nmap 脚本和指纹 exploits - Metasploit 模块和基于 Python 的漏洞利用程序。 受影响设备 以下设备均由 Awind 贴牌生产，因此受相同问题影响。 Crestron Airmedia AM-100 Crestron Airmedia AM-101...

AI-PASSWORD-TESTING-AGENT

AI密码攻击编排器 - 防御性研究仓库 ⚠️ 法律免责声明与研究目的 本仓库仅用于防御性网络安全研究和教育目的 不包含可利用代码 - 本仓库仅包含理论研究、概念分析和防御性对策 不包含攻击性工具 - 不含可运行的漏洞利用、攻击脚本或自动化攻击工具 防御性重点 - 所有内容旨在帮助组织防御AI增强型密码攻击 学术研究 - 这是一份面向安全专业人士和研究者的技术能力分析 合规性 - 所有内容符合负责任的披露和道德安全研究标准 访问本仓库即表示您同意： 仅将本信息用于防御目的 不尝试将任何描述的概念武器化或投入实战 以负责任的方式与安全社区分享研究成果 遵守所有适用的法律法规 仓库概述...

CVE-2019-9053

Fixed it bcz of https://tryhackme.com/room/easyctf : enjoy Critical Issues Fixed 1. Python 2 to Python 3 Compatibility Old: print "string" New: print"string" Changed all print statements to print functions Updated string formatting to use f-strings 2. Deprecated optparse Library Old: import...

CVE-2025-10658

Exploit: SupportCandy Guest OTP Brute Force → Account Takeover 1 Initiate OTP login flow browser Open: root@kitploit: /support/ Select guest / OTP login Enter target email e.g. [email protected] Submit 2 Extract required values from the OTP form In DevTools → Network →...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Exploit de denegación de servicio para el listener HTTPS de Sliver C2. Fuerza bruta el nonce de codificación PNG por sesión y entrega una bomba de descompresión que agota la memoria del servidor. Publicado como GHSA-663m-7x7m-g4fw. Resumen El canal C2 HTTPS de Sliver...

CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

FTPBuster

FTPBuster FTPBuster is a powerful command-line brute-forcing tool designed to brute-force FTP, SFTP, and explicit FTPS servers by performing dictionary-based attacks. It is intended for ethical hacking and penetration testing Features Brute-force support for FTP , SFTP , and explicit FTPS AUTH TL...

EUVD-2026-75264

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...