certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

ssb

SSB S ecure S hell B ruteforcer — A faster & simpler way to bruteforce SSH server. Installation from Binary Download a pre-built binary from releases page, unpack and run! Or: ▶ sudo curl -sSfL 'https://git.io/kitabisa-ssb' | sh -s -- -b /usr/local/bin from Source Need go1.14+ compiler installed...

CVE-2018-9995_dvr_credentials

Tool show DVR Credentiales Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa Exploit: $ curl...

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as...

ibrute

UPDATE If you are concerned about cloud storage security, please read What if I was a cloud? and leave your feedback please. Thank you. The end of fun, Apple have just patched Here is appleID password bruteforce pOc. It's only p0c, so there is no MultiThreading feature Save-State-On-Exception...

LSTAR

LSTAR - Aggressor A plugin from initial access to domain takeover, enabling intranet traversal With the goal of simplifying CS right-click operations and facilitating integration, referencing a large number of post-exploitation plugins Restructured and enriched host credential acquisition,...

CVE-2026-78628

The Okta Credential Provider for Windows contains an improper input validation vulnerability. The software fails to validate the buffer size and packed string offsets of a serialized credential buffer before interpreting it as a Kerberos logon structure . Processing a malformed buffer can cause t...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

SCCMSecrets

SCCMSecrets SCCMSecrets.py is an SCCM policies exploitation tool. It goes beyond NAA credentials extraction, and aims to provide a comprehensive approach regarding SCCM policies exploitation. The tool can be executed from various levels of privileges, and will attempt to uncover potential...

CredCrack

CredCrack ⛔ DEPRECATED. This repo is no longer being maintained. Please consider using CrackMapExec. Introduction CredCrack is a fast and stealthy credential harvester. It exfiltrates credentials recusively in memory and in the clear. Upon completion, CredCrack will parse and output the credentia...

CVE-2026-103568

A race condition vulnerability exists in Windows Credential Providers due to concurrent execution using a shared resource with improper synchronization. This flaw allows an authorized attacker to achieve local privilege elevation . Exploitation details and specific affected versions are not provi...

credmap

credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...

CVE-2026-69736

A race condition exists in the Windows Credential Manager due to concurrent execution using a shared resource with improper synchronization. This vulnerability allows an authorized attacker to perform a local privilege escalation . No specific software versions or exploit links are provided in th...

CVE-2026-70580

A missing authentication vulnerability exists in a critical function within Windows Credential Guard . This flaw allows an authorized attacker to perform spoofing locally . The vulnerability has a HIGH base severity score of 8.8 and is categorized under CWE-306 . Official remediation is available...

adfly

adfly active directory query tool using LDAP Protocol , helps red teamer / penetration testers to validate users credentials , retrieve information about AD users , AD groups AD fly is Tool uses LDAP Protocol for users authentication access and queries of information ,since AD fly uses LDAP for...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit Brute-force Mitigation Bypass Exploit Code for CVE-2019-17240 aka Bludit = 3.9.2 Bruteforce Mitigation Bypass Exploit Links: ExploitDB-48942 PacketStorm Expected outcome: Discover login credentials, bypassing Brute-force Mechanism on host running Bludit =3.9.2...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. Apply the patches in the host-patches folder to the Linux host and QEMU. 2. Start an SEV-SNP VM. 3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO". 4. Spam the attack command in QEMU several times. 5. Once the exploit...

CVE-2020-25078

D-Link DCS Series Account Password Information Disclosure Vulnerability D-Link DCS Series account password information disclosure vulnerability, obtain account password via script to log in. Vulnerability ID CVE-2020-25078 Tool Usage python3 CVE-2020-25078.py -u http://127.0.0.1:1111 single URL...

LaZagne

The LaZagne Project !!! Description The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for...

AttackSurfaceMapper

AttackSurfaceMapper AttackSurfaceMapper ASM is a reconnaissance tool that uses a mixture of open source intelligence and active techniques to expand the attack surface of your target. You feed in a mixture of one or more domains, subdomains and IP addresses and it uses numerous techniques to find...