credactor

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

aigate

aigate Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files. Quick start root@kitploit: pip install aigate && aigate setup-all That's it. This installs a background proxy redact mode, a PostToolUse hook for file scanning,...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

Confluence-Question-CVE-2022-26138-

Confluence-Question-CVE-2022-26138 Atlassian Confluence Server и Data Center: CVE-2022-26138 При установке и включении приложения «Questions for Confluence» на Confluence Server или Data Center создается учетная запись пользователя Confluence с именем «disabledsystemuser» и паролем...

CVE-2015-7755-POC

CVE-2015-7755-POC Détection de vulnérabilité CVE-2015-7755 utiliser SSH pour se connecter à ces versions vulnérables : ScreenOS 6.2.0r15—6.2.0r18，6.3.0r12—6.3.0r20 Juniper Networks utilisateur : root mot de passe : %sun='%s' = %u...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials

An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. id: CVE-2025-32815 info: name: NetMRI 7.6.1 - Authentication Bypass via Hardcoded Credentials author: iamnoooob,pdresearch severity: medium description: | An issue was discovered i...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

Silent-Call

Silent;Call Accès root distant en pré-authentification sur Cisco Unified Communications Manager 15.x Trois requêtes HTTP. Zéro identifiant. Accès root. Chaque appel est désormais à vous. Kill Chain Step| Composant| Description ---|---|--- 1| Spoofhack| L'usurpation de l'en-tête X-Forwarded-For...

CVE-2022-26138

CVE-2022-26138 POC Description root@kitploit: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with...

juniper-cve-2015-7755

Juniper CVE-2015-7755 & CVE-2015-7756 Ce dépôt contient des notes, des binaires et des informations connexes issues de l'analyse des vulnérabilités CVE-2015-7755 & CVE-2015-7756 dans Juniper ScreenOS. Pour plus d'informations sur ces problèmes, veuillez consulter les URL ci-dessous :...

MikroRoot

MikroRoot Version automatisée de CVE-2018-14847. Elle va scraper Shodan pour des hôtes vulnérables, puis tenter de les exploiter. Comment utiliser Notez que ce script ne fonctionnera PAS avec Python 2.x. Utilisez uniquement Python 3+ MikroRoot: python3 MikroRoot.py -k SHODANKEY -p page count User...

TFTPlunder

TFTPlunder : un exploit pour CVE-2023-29930 Ceci est un script d'exploitation pour une vulnérabilité de lecture/écriture aveugle de fichiers dans le serveur de provisioning TFTP de Genesys anciennement InIn. Informations sur la vulnérabilité Cette vulnérabilité est due à des options de...

mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password

mySCADA myPRO 7 Identifiants codés en dur CVE-2018-11311 https://vulners.com/cve/CVE-2018-11311 https://www.exploit-db.com/exploits/44656/ http://myscada.org/wp-content/uploads/downloads/BOXv7/changelog.txt root@kitploit: Changelog v7.0.46 ----------------- - fix of possible vulnerability as...

cve-2026-19900-PoC

CVE-2026-19900 LB-LINK X-PRO Contournement d'authentification et RCE via utilisateur nul CVE-2026-19900 Contournement d'authentification et RCE via identifiants codés en dur et utilisateur nul. Contournement via en-tête : Cookie:user=null Utilisation Compiler et exécuter le script avec un hôte...