FGscanner

FantaGhost URL Scanner 1.1 Released date : 2014/02/05 Advanced web directory scanner with proxy and TOR support About FGscanner is an advanced opensource web directory scanner. It find hidden contents on a web server using dictionary-like attack. FantaGhost URL scanner support proxy and TOR...

Nosql-Exploitation-Framework

Nosql-Exploitation-Framework A FrameWork For NoSQL Scanning and Exploitation Framework NoSQL Exploitation Framework 2.02b Released Author NoSQL Exploitation Framework Authored By Francis Alexander Wiki NoSQL Exploitation Framework Wiki on Installation & Usage -...

cheetah

English description | 中文说明 0x00 cheetah Cheetah is a dictionary-based brute force password webshell tool, running as fast as a cheetah hunt for prey. Cheetah's working principle is that it can submit a large number of detection passwords based on different web services at once, blasting efficienc...

buffalo

Buffalo A Python 3 script to execute dictionary/wordlist attacks on a target SSH server using two text files as input. Authored for the purposes of my Intel technical screening. Installation This script depends on Paramiko and Colorama. Install the dependencies via pip install -r requirements.txt...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit Brute-force Mitigation Bypass Exploit Code for CVE-2019-17240 aka Bludit = 3.9.2 Bruteforce Mitigation Bypass Exploit Links: ExploitDB-48942 PacketStorm Expected outcome: Discover login credentials, bypassing Brute-force Mechanism on host running Bludit =3.9.2...

jwt-cracker

jwt-cracker Simple cracker de fuerza bruta para tokens JWT HS256, HS384 y HS512. Efectivo solo para vulnerar tokens JWT con secretos débiles. Recomendación : utiliza secretos largos y fuertes o tokens RS256. Instalación Con npm: npm install --global jwt-cracker Uso Desde la línea de comandos:...

lama

lama Lama, la aplicación que no tiene pelos en la lengua. Descripción Lama es una herramienta GNU Linux para generar listas de palabras. El objetivo es obtener un diccionario de contraseñas personalizado para un objetivo particular, ya sea físico o moral. Por lo tanto, es importante que las...

jwt_tool

El kit de herramientas JSON Web Token v2 jwttool.py es un kit de herramientas para validar, forjar, escanear y manipular JWTs JSON Web Tokens. Su funcionalidad incluye: Comprobar la validez de un token Probar exploits conocidos: CVE-2015-2951 La vulnerabilidad de omisión de firma alg=none...

wacker

Resumen Un conjunto de scripts para ayudar a realizar un ataque de diccionario en línea contra un punto de acceso WPA3. Wacker aprovecha la interfaz de control de wpasupplicant para controlar las operaciones del demonio supplicant y obtener información de estado y notificaciones de eventos, lo qu...

cbrutekrag

cbrutekrag Test di penetrazione su server SSH utilizzando attacchi a dizionario. Scritto in C. brute krag significa "forza bruta" in afrikáans Dichiarazione di non responsabilità Questo strumento è solo per scopi di test etici. cbrutekrag e i suoi proprietari non possono essere ritenuti...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Logotipo de Brutemap |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

bitcracker

BitCracker BitCracker es la primera herramienta de código abierto para descifrar contraseñas de dispositivos de almacenamiento Disco Duro, Pendrive USB, tarjeta SD, etc... cifrados con BitLocker, una función de cifrado disponible en Windows Vista, 7, 8.1 y 10 ediciones Ultimate, Pro y Enterprise...

CVE-2026-92921: Use of Password Hash With Insufficient Computational Effort

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

PT-2026-94252

Name of the Vulnerable Software and Affected Versions admin3 versions 3.0.0 through 3.0.0 Description Account passwords are stored using a single-round MD5 hash with only the username as salt and no key derivation function a method used to strengthen passwords by adding computational cost. This...

Improper Handling of Alternate Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Alternate Encoding in its password normalization, which applies Unicode NFKC compatibility normalization before hashing and so folds fullwidth and other compatibility characters to their ASCII equivalents. An attack...

CVE-2026-19611

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

CVE-2026-19611

The vulnerable component is org.wildfly.security/wildfly-elytron-password-impl in WildFly Elytron. Password hashing/verification applies Unicode NFKC normalization, collapsing fullwidth characters to ASCII equivalents, which reduces the effective password keyspace. This allows a remote attacker t...

Generation of Predictable IV with CBC Mode

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...

PT-2026-79049

Name of the Vulnerable Software and Affected Versions WildFly Elytron affected versions not specified Description Password hashing and verification processes normalize input using Unicode NFKC Normalization Form Compatibility Composition, which can collapse fullwidth characters into their ASCII...

CVE-2026-57263

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force...