Klyda

El proyecto Klyda ha sido creado para ayudar en ataques rápidos basados en credenciales contra aplicaciones web en línea. Klyda soporta el uso desde simples rociados de contraseñas hasta grandes ataques de diccionario multihilo. Klyda es un proyecto nuevo, y estoy buscando contribuciones. Cualqui...

Kraken

Una herramienta basada en Python para centralizar y agilizar ataques de fuerza bruta Acerca del Proyecto Kraken es una potente herramienta basada en Python diseñada para centralizar y agilizar diversas tareas de fuerza bruta. Kraken proporciona un conjunto de herramientas para que los profesional...

credential-attacks-toolkit

CredAttack — Kit de Ataques de Credenciales ⚠️ AVISO LEGAL — Solo pruebas de seguridad autorizadas. Usar esta herramienta contra sistemas que no posees o para los que no tienes permiso escrito explícito es ilegal según la Computer Fraud and Abuse Act EE. UU., la Computer Misuse Act Reino Unido y...

CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer P2P relay technique. The activity, codenamed Operatio...

PYSEC-2026-2008 vantage6 vulnerable to username timing attack

Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks Workarounds No...

Containing a domain compromise: How predictive shielding shut down lateral movement

In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...

CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerat...

CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerat...

VulnForge

VulnForge AI-Powered Vulnerability Scanner & Auto-Exploit E...

CVE-2025-25236

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks...

EUVD-2017-6749

Malware in sbrugna...

EUVD-2020-25479

Malware in sbrugna...

EUVD-2024-0170

Malicious code in bioql PyPI...

CVE-2024-21671

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

How to Eliminate Identity-Based Threats

Despite significant investments in advanced technologies and employee training programs, credential and user-based attacks remain alarmingly prevalent, accounting for 50-80% of enterprise breaches1,2. While identity-based attacks continue to dominate as the leading cause of security incidents, th...

vantage6 vulnerable to username timing attack

Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks Workarounds No...

CVE-2024-21671

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

PYSEC-2024-31

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

CVE-2024-21671 vantage6 username timing attack

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...