JWT_Brute

JWTBrute Example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9.56wwCrB9tIgmUnYpLPxkO8GYj1soCjuuskTlbHGg8 root@kitploit: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 base64 decode "alg":"HS256","typ":"JWT" eyJ1c2VyIjoibmFuYSIsImFjdGlvbiI6InVwbG9hZCJ9 base64 decode...

Nosql-Exploitation-Framework

Nosql-Exploitation-Framework Un Framework para escaneo y explotación de NoSQL NoSQL Exploitation Framework 2.02b liberado Autor NoSQL Exploitation Framework creado por Francis Alexander Wiki Wiki de NoSQL Exploitation Framework sobre instalación y uso -...

cupp

CUPP - Common User Passwords Profiler About The most common form of authentication is the combination of a username and a password or passphrase. If both match values stored within a locally stored table, the user is authenticated for a connection. Password strength is a measure of the difficulty...

Arjun

Arjun Suite de Descubrimiento de Parámetros HTTP ¿Qué es Arjun? Arjun puede encontrar parámetros de consulta para endpoints URL. Si no entiendes lo que eso significa, está bien, sigue leyendo. Las aplicaciones web utilizan parámetros o consultas para aceptar entrada del usuario, toma el siguiente...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

cameradar

Cameradar RTSP stream access tool Cameradar scans RTSP endpoints on authorized targets, and uses dictionary attacks to bruteforce their credentials and routes. What Cameradar does Detects open RTSP hosts on accessible targets. Detects the device model that streams the RTSP feed. Attempts...

MifareClassicTool

MIFARE Classic Tool MCT An Android NFC app for reading, writing, analyzing, etc. MIFARE Classic RFID tags. Read this information in other languages: English 简体中文 正體中文 Helpful links: MIFARE Classic Tool Donate Version on Google Play Screenshots Help & Info/User Manual Additional stuff Documentatio...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

Narthex

Narthex Narthex Griego: Νάρθηξ, νάρθηκας es un generador de diccionarios modular y minimalista para sistemas operativos Unix y similares a Unix escrito en C y Shell. Contiene programas autónomos al estilo Unix para la creación de diccionarios personalizados que pueden utilizarse para recuperación...

Zip-Cracker-

Zip Cracker Este script solo admite archivos Zip en esta versión También puedes usar este script con crunch Compatible con múltiples plataformas Usage: zipcracker.py options root@kitploit: Options: --version show program's version number and exit -h, --help show this help message and exit -f...

Admin-Panel_Finder

Admin Panel Finder Una extensión de Burp Suite que enumera interfaces de administración de infraestructura y aplicaciones. Referencias OWASP: Clasificación : Pruebas de Seguridad en Aplicaciones Web 02-Pruebas de Gestión de Configuración y Despliegue OTG v4 : OWASP OTG-CONFIG-005 WSTG :...

FTPBuster

FTPBuster FTPBuster is a powerful command-line brute-forcing tool designed to brute-force FTP, SFTP, and explicit FTPS servers by performing dictionary-based attacks. It is intended for ethical hacking and penetration testing Features Brute-force support for FTP , SFTP , and explicit FTPS AUTH TL...

fuckshell

Fuckshell Simple Webshell Scanner. Using, defined files with dictionary!...

CVE-2026-88792

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

CVE-2025-15697

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-88792 Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

EUVD-2026-81346

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

CVE-2026-88792

CVE-2026-88792 affects the Dictionary WordPress plugin through version 1.0 . The plugin lacks authorisation, sanitisation, or escaping when adding or updating dictionary entries, enabling unauthenticated users to store arbitrary web scripts that execute when another user views an affected entry —...

CVE-2025-15697

CVE-2025-15697 affects the Dictionary WordPress plugin through version 1.0 , which fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against users who are i...

EUVD-2025-210927

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...