OracleOTM

OracleOTM 用于利用 CVE-2021-35616 的 Python 工具 该脚本按模块工作，我按以下顺序实现： ► 用户名枚举 ► 搜索默认凭据 ► 使用 DBXML servlet 运行 SQL 查询 ► 完全利用与 JSP 执行 脚本语法如下： .\OracleOTM.py module host TXT file additional parameters 用户名枚举：.\OracleOTM.py enum hosts TXT file -u users.txt 搜索默认凭据：.\OracleOTM.py default hosts TXT file 使用 DBXML...

kerbrute

kerbrute An script to perform kerberos bruteforcing by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate: Valid username/passwords pairs Valid usernames Usernames withou...

plown

概要 PlownはPlone CMS向けのセキュリティスキャナです。Ploneは主要CMSの中でも最も優れたセキュリティ実績を持ち、非常に安全とされていますが、設定ミスや脆弱なパスワードによりシステムへの侵入が可能になる場合があります。Plownは、ユーザー名やパスワードの発見を容易にし、システム管理者がPloneサイトを強化するためのアシスタントとして機能するように開発されました。 インストール PlownはPythonで書かれており、インストールは不要です。GitHubリポジトリをクローンして実行するだけです。 user@user:/Desktop$ git...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - ブルートフォースバイパス - CVE-2019-17240 CVE-2019-17240 に基づく非常にシンプルなスクリプト。 元のPOCと解説: https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p ./passwordsfilelist.txt -l :...

azbelt

azbelt DLL independiente y extensión sliver para enumerar credenciales relacionadas con Azure, principalmente en máquinas unidas a AAD Módulos aadjoin - Obtiene información sobre el estado de AAD de la máquina mediante NetGetAadJoinInformation credman - Obtiene credenciales del Administrador de...

Atlas

Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...

CVE-2025-26788

CVE-2025-26788 Configuración del entorno Paso 1 - Verificar la ejecución de Docker Desktop docker version Paso 2 - Construir la imagen cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Paso 3 - Ejecutar el contenedor docker run -d --name skfs --hostname skfs.localdomain...

EUVD-2026-74846

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

EUVD-2026-70147

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48767

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70433

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...