plown

关于 Plown 是一款针对 Plone CMS 的安全扫描器。尽管 Plone 在所有主流 CMS 中拥有最佳的安全记录，且被认为高度安全，但错误配置和弱密码仍可能导致系统入侵。Plown 旨在简化用户名和密码的发现过程，并作为系统管理员的助手，帮助加强其 Plone 网站的安全性。 安装 Plown 使用 Python 编写，无需安装。只需克隆 GitHub 仓库并运行即可。 user@user:/Desktop$ git clonehttps://github.com/unweb/plown user@user:/Desktop$ cd plown...

kerbrute

kerbrute 一个通过使用 Impacket 库执行 Kerberos 暴力破解的脚本。 执行时，输入接收一个用户或用户列表以及一个密码或密码列表。然后进行暴力破解攻击以枚举： 有效的用户名/密码组合 有效的用户名 不需要预认证的用户名 结果，脚本会生成发现的凭证列表，以及由这些有效凭证生成的 TGT。 安装 从 pypi： root@kitploit: pip3 install kerbrute 从仓库： root@kitploit: git clone https://github.com/TarlogicSecurity/kerbrute cd kerbrute pip...

OracleOTM

OracleOTM 用于利用 CVE-2021-35616 的 Python 工具 该脚本按模块工作，我按以下顺序实现： ► 用户名枚举 ► 搜索默认凭据 ► 使用 DBXML servlet 运行 SQL 查询 ► 完全利用与 JSP 执行 脚本语法如下： .\OracleOTM.py module host TXT file additional parameters 用户名枚举：.\OracleOTM.py enum hosts TXT file -u users.txt 搜索默认凭据：.\OracleOTM.py default hosts TXT file 使用 DBXML...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - 暴力破解绕过 - CVE-2019-17240 基于 CVE-2019-17240 的极简脚本。 原始 PoC 与说明：https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p ./passwordsfilelist.txt -l :...

azbelt

azbelt DLL independiente y extensión sliver para enumerar credenciales relacionadas con Azure, principalmente en máquinas unidas a AAD Módulos aadjoin - Obtiene información sobre el estado de AAD de la máquina mediante NetGetAadJoinInformation credman - Obtiene credenciales del Administrador de...

Atlas

Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...

CVE-2025-26788

CVE-2025-26788 环境搭建 步骤1 - 确认 Docker Desktop 运行 docker version 步骤2 - 构建镜像 cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . 步骤3 - 运行容器 docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs...

EUVD-2026-74846

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

EUVD-2026-70147

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48767

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70433

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...