Advanced Hash Manipulation: Dagon

Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to ASCII, an...

Nextcloud: Android content provider exposes password-protected share password hashes

Summary Nextcloud Android client v1.4.3 has a globally available content provider which exposes the bcrypt password hashes for password protected shared files and folders. Description Android apps can use a content provider to handle storage and retrieval of data. Content providers that are...

U.S. Dept Of Defense: Admin Salt Leakage on DoD site.

Hi there, the login page located at https://█████████/████████/adminapi/administrator.cfc is leaking administrator salt which is required at authentication purpose. PoC: Navigate to https://████/████████/adminapi/administrator.cfc?method=getSalt which will show you the admin salt ████████ which i...

Design Flaw Vulnerability in MallBuilder Mall Page CAPTCHA of Farfound Group

MallBuilder is a multi-user online shopping mall solution based on PHP + MYSQL. A design flaw vulnerability exists in the Farfound Group MallBuilder mall page authentication code. Allows attackers to bypass the page verification code for brute force cracking...

Driver's Choice Android app suffers from arbitrary account login vulnerability

Driving Chant is an electric car time-sharing platform developed by Spruce Wisdom. A vulnerability exists in the Driving Chant Android app. The vulnerability is due to a design flaw in the SMS verification code login function, which can be exploited by an attacker to log in to another person's...

CVE-2014-9690

Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier's solution is not random enough. As a result, brute force cracking the...

CVE-2014-9690

CVE-2014-9690 affects Huawei WS318 home gateways (software versions including V100R001C01B022 and earlier). The underlying issue is an insufficiently random RNG used by the vendor’s WPS implementation, enabling offline PIN brute-forcing. Exploitation allows an attacker to crack the WPS PIN and ga...

Information leakage vulnerability in Yunmai Good Light APP

Yunmai Good Light APP is a special app for smart weight scale launched by Yunmai. There is an information leakage vulnerability in Yunmai Good Light APP. Since the entire APP only uses token as a security restriction, the token generation algorithm can be cracked to obtain sensitive information,...

Password Cracking Web Front-End: Hashview

Password Cracking Web Front-End Hashview is a tool for security professionals to help organize and automate the repetitious tasks related to password cracking. Hashview is a web application that manages hashcat https://hashcat.net commands. Hashview strives to bring constiency in your hashcat tas...

WMD (Weapon of Mass Destruction) - Python framework for IT security tools

This is a python tool with a collection of IT security software. The software is incapsulated in "modules". The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command "use modulecall", e.g. "use apsniff", to activate the module. ...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

CVE-2017-5544

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout each of the login attempts will occupy a...

CVE-2017-5544

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout each of the login attempts will occupy a...

Design/Logic Flaw

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout each of the login attempts will occupy a...

CVE-2017-5544

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout each of the login attempts will occupy a...

rc4 Password Cracking Vulnerability in LOGBASE Ops Security Management System from Sifo-Di

The LOGBASE O&M security management system from Sifo-Di provides O&M security audits for O&M staff. A rc4 password cracking vulnerability exists in the LOGBASE Operations and Maintenance Security Management System from Sifo-Dee. As the system comes with a URL link to decrypt its own "RC4",...

Hijacker - Aircrack, Airodump, Aireplay, MDK3 and Reaver GUI Application for Android

Hijacker is a Graphical User Interface for the wireless auditing tools airodump-ng, aireplay-ng and mdk3. It offers a simple and easy UI to use these tools without typing commands in a console and copy&pasting MAC addresses. This application requires an android device with a wireless adapter that...

Hashcat v3.20 - World's Fastest and Most Advanced Password Recovery Utility

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 160 highly-optimized hashing algorithms. hashcat currently supports CPU's, GPU's other hardware-accelerators on Linux, Windows and OSX, and has facilities to help enable...

DPAT - Domain Password Audit Tool for Pentesters

This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as oclHashcat.pot generated from the oclHashcat tool during password cracking. The report is an HTML report with clickable links. You can run the...

Domain Password Audit Tool: DPAT

Domain Password Audit Tool This is a python script that will generate password use statistics from password hashes dumped from a domain controller and a password crack file such as oclHashcat.pot generated from the oclHashcat tool during password cracking. The report is an HTML report with...