XploitSPY

A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...

EyeWitness

EyeWitness - Web Screenshot Tool EyeWitness is designed to take screenshots of websites, provide server header info, and identify default credentials if known. Now powered by Chromium browser for better reliability and easier installation. 🚀 Key Features Cross-platform support - Windows, Linux,...

DefaultCreds-cheat-sheet

Default Credentials Cheat Sheet One place for all the default credentials to assist pentesters/blue Teamers during engagements, featuring default login/password details for various products sourced from multiple references. P.S : Most of the credentials were extracted from changeme,routersploit a...

Monitorizer

Monitorizer The Ultimate Subdomain Monitoring Framework Installation ❗ Disclaimer --- Admin users are able to execute code on the local server make sure to change the default password at otherwise use it at your own risk Using docker $ curl...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access

Tieline IP Audio Gateway 2.6.4.8 and below is affected by a vulnerability in the web administrative interface that could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. id: CVE-2021-35336 info: name: Tieline IP Audio Gateway =2.6.4.8 -...

Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution

Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the /api/monitors/import and /api/alert/defines/import endpoints. An authenticated user can submit a YAML file that constructs an org.h2.jdbc.JdbcConnection with a malicio...

Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection

Wireless Multiplex Terminal Playout Server =20.2.8 has a default account with a password of pokon available via its web administrative interface. id: CVE-2020-35338 info: name: Wireless Multiplex Terminal Playout Server =20.2.8 - Default Credential Detection author: Jeya Seelan severity: critical...

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users. id: CVE-2026-44825 inf...

Vue Vben Admin - Default Credentials

Vue Vben Admin 2.10.1 contains a broken authentication caused by hardcoded credentials in the backend, letting attackers log in without proper authorization, exploit requires access to the login interface. id: CVE-2025-25570 info: name: Vue Vben Admin - Default Credentials author: 0xAkoko severit...

CVE-2019-15813

CVE-2019-15813 This container was made to explain and demonstrate how CVE-2019-15813 Sentrifugo works Sentrifugo V3.2 Sentrifugo is a Human Resource Management System How to Install docker-compose up Default crentials to test ----Super Admin---- Username : empp0001 Password : 5faa7bdf3d7af...

scan_CVE-2020-29583

Scanner for Zyxel products which are vulnerable due to an undocumented user account CVE-2020-29583 Vuln details: https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html But I'm not sure if it's really possible to login with zyfwp via the web interface? Any reports would be...

url-tracker

URL Tracker v0.5.0 URL Tracker is a robust and scalable web application designed to monitor and track URLs, log changes, and provide detailed insights into the status and behavior of various web resources. Built on top of Sails.js, this application is perfect for tracking URLs for uptime, content...

Backdooring-ZMM100-FingerPrint-Devices

Hacking Embedded Devices : Hardware platform ZMM100 : The fingerprint access control device Made by ZKSoftware. Default User/Password : root:solokey Protocol : Telnet 23. Scripts : pwnit.py : Automated tool for hacking devices. hell : second backdoor. leak-data.sh : third backdoor. YouTube Video ...

Passhunt

Passhunt Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords. Screenshot Pre-requisites Make sure you have installed the following: - Python 3.0 or later. - pip3 sudo apt-get...

RedHunt-OS

RedHunt Linux Distribution VM v2 Virtual Machine for Adversary Emulation and Threat Hunting by RedHunt Labs RedHunt OS aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats...

Dejavu

DejaVU - Open Source Deception Platform DejaVu part of Camolabs.io is a deception platform which can be used to deploy decoys on both cloudfor now we support AWS and internal network. This is our presentation at Blackhat Europe where we show how we can leverage Deception to detect common adversar...

moukthar

Moukthar Remote adminitration tool for android Demo Features Permissions bypass android 12 below Keylogger Notifications listener SMS listener Phone call recording Image capturing and screenshots Video recording Persistence Read & write contacts List installed applications Download & upload files...

CVE-2017-7921

CVE-2017-7921 Hikvision unauthorized access detection poc and password detection Usage： Usage: -a 加载Poc模块 -b 加载密码爆破模块 -e 加载Exp模块 -f string 文件名称 默认为空 -i string 输入ip地址 eg:192.0.0.1-192.0.0.255 -p string 密码 default:12345 default "12345" -s string 协议 eg:http default "http" -t int 线程数量 默认50 default 50...