odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool — это инструмент с открытым исходным кодом для тестирования на проникновение , который проверяет безопасность баз данных Oracle удаленно. Примеры использования ODAT: У вас есть прослушивающий...

snmpwn

SNMPwn est un outil d'attaque et d'énumération d'utilisateurs SNMPv3. C'est un outil de sécurité légitime conçu pour être utilisé par des professionnels de la sécurité et des testeurs d'intrusion contre des hôtes que vous avez l'autorisation de tester. Il exploite le fait que les systèmes SNMPv3...

cameradar

Cameradar RTSP stream access tool Cameradar scans RTSP endpoints on authorized targets, and uses dictionary attacks to bruteforce their credentials and routes. What Cameradar does Detects open RTSP hosts on accessible targets. Detects the device model that streams the RTSP feed. Attempts...

legba

legba Rejoignez la communauté du projet sur notre serveur ! Legba est un outil multiprotocole de force brute d'identifiants / vaporisation de mots de passe et d'énumération, construit avec Rust et le runtime asynchrone Tokio afin d'atteindre de meilleures performances et une meilleure stabilité...

wodat

wodat Windows Oracle Database Attack Tool Simple port of the popular Oracle Database Attack Tool ODAT https://github.com/quentinhardy/odat to C .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code. Perform password based attacks e.g...

ssb

SSB S ecure S hell B ruteforcer — A faster & simpler way to bruteforce SSH server. Installation from Binary Download a pre-built binary from releases page, unpack and run! Or: root@kitploit: ▶ sudo curl -sSfL 'https://git.io/kitabisa-ssb' | sh -s -- -b /usr/local/bin from Source Need go1.14+...

RTSPbrute

RTSPBrute Inspired by Cameradar Features Find accessible RTSP streams on any target Brute-force stream routes Brute-force credentials Make screenshots on accessible streams Generate user-friendly report of the results: .txt file with each found stream on new line .html file with screenshot of eac...

hostscan

hostscan 0.2 Hostscan은 특정 호스트 범위를 스캔할 수 있는 PHP 도구로, 주로 정보 수집 및 약한 비밀번호 테스트를 위해 사용됩니다. 침투 테스트 도구라고 볼 수 있으며, 제가 자주 수행하는 일부 테스트를 자동화하기 위해 만들었습니다. PHP 기반이기 때문에 클라이언트 측 소프트웨어에 비해 상당히 느리게 작동합니다. How it works? IP 범위예: 127.0.0.1 - 127.0.0.10를 제공해야 합니다. 프로그램은 선택한 옵션에 따라 각 주소에 대해 개별적으로 작업을 수행한 다음 응답을 출력합니다...

CVE-2021-46366

CVE-2021-46366 : Attaque par force brute de mots de passe via CSRF + Redirection Ouverte dans Magnolia CMS Un problème dans la page de connexion de Magnolia CMS v6.2.3 et versions antérieures permet aux attaquants d'exploiter à la fois une vulnérabilité de Redirection Ouverte et une Cross-Site...

solrradar

Фреймворк массовой разведки и эксплуатации для Apache Solr Внедрение Velocity-шаблона → Удалённое выполнение кода 📑 Содержание Обзор уязвимости Затронутые версии Возможности Установка Использование Доказательство концепции Техническое погружение Методология обнаружения Защита и смягчение Дисклейм...

ubuntu-privesc-lab

ubuntu-privesc-lab Flusso di lavoro completo di penetration testing: brute force delle credenziali, accesso SSH ed escalation dei privilegi CVE-2021-4034 PANORAMICA Questo progetto dimostra un flusso di lavoro completo di penetration testing contro una macchina virtuale Ubuntu vulnerabile. La...

CVE-2026-65895

CVE-2026-65895 affects Grav API Plugin prior to 1.0.10. The issue allows an authenticated user with the api.config.write privilege to modify security-critical plugin configuration scopes, namely rate limiting and CORS. This can disable site-wide rate limiting (facilitating credential brute-forcin...

MAL-2026-10638 Malicious code in monogrok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...

CVE-2026-5040 Weak Password Hashing Mechanism in TP-Link Deco M5

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...

CVE-2026-8697

Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to brute-force valid credentials via SSH. Successful...

CVE-2025-64526

Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from ctx.request.body.email, including on routes whose body schema does not contain an email field...

FlowiseAI Exposes Basic Auth Credentials via API

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Severity | Medium | | CWE | CWE-522 Insufficiently Protected Credentials | | Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 | | Practical Exploitability | Medium | | Developer Approv...

Strapi 安全漏洞

Strapi is an open-source content management system CMS developed by the Strapi community in France. Versions of Strapi prior to 5.45.0 contained security vulnerabilities. These vulnerabilities stemmed from a rate-limiting mechanism in the users-permissions plugin, which derived rate-limiting keys...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893

Signal K Server’s WebSocket login path (via ws signalk/v1/stream) processes login attempts without rate limiting, enabling credential brute‑forcing at ~20 attempts/sec per WebSocket connection and bypassing HTTP rate limiting. Affected cve: CVE-2026-41893 concerns pre‑2.25.0 behavior. Technical d...