436 matches found
OracleOTM
OracleOTM Herramienta en Python para explotar CVE-2021-35616 El script funciona por módulos, los cuales implementé en el siguiente orden: ► Enumeración de nombres de usuario ► Búsqueda de credenciales por defecto ► Ejecución de una consulta SQL usando el servlet DBXML ► Explotación completa y...
kerbrute
kerbrute 一个通过使用 Impacket 库执行 Kerberos 暴力破解的脚本。 执行时，输入接收一个用户或用户列表以及一个密码或密码列表。然后进行暴力破解攻击以枚举： 有效的用户名/密码组合 有效的用户名 不需要预认证的用户名 结果，脚本会生成发现的凭证列表，以及由这些有效凭证生成的 TGT。 安装 从 pypi： pip3 install kerbrute 从仓库： git clone https://github.com/TarlogicSecurity/kerbrute cd kerbrute pip install -r requirements.txt 使用...
plown
Acerca de Plown es un escáner de seguridad para el CMS Plone. Aunque Plone tiene el mejor historial de seguridad de cualquier CMS importante y se considera altamente seguro, las configuraciones incorrectas y las contraseñas débiles podrían permitir intrusiones en el sistema. Plown ha sido...
Bludit-3-9-2-bb
Bludit-3-9-2-bb Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240 Very simple script based on CVE-2019-17240. Original POC and explanation: https://github.com/bludit/bludit/pull/1090. usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p...
azbelt
azbelt DLL independiente y extensión sliver para enumerar credenciales relacionadas con Azure, principalmente en máquinas unidas a AAD Módulos aadjoin - Obtiene información sobre el estado de AAD de la máquina mediante NetGetAadJoinInformation credman - Obtiene credenciales del Administrador de...
Atlas
Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...
CVE-2025-26788
CVE-2025-26788 Configuración del entorno Paso 1 - Verificar la ejecución de Docker Desktop docker version Paso 2 - Construir la imagen cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Paso 3 - Ejecutar el contenedor docker run -d --name skfs --hostname skfs.localdomain...
EUVD-2026-74846
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...
CVE-2026-84674
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-84674
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-84674
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
EUVD-2026-70147
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-84674
The Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) is vulnerable to a missing permission check in several HTTP endpoints. This flaw allows users with Overall/Read permissions to enumerate credentials IDs for credentials stored in Jenkins. Attackers can leverage these identified I...
PT-2026-84797
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-53548: Improper Authorization
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...
CVE-2026-48767
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...
CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...
CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...