Detect Shared Passwords: shard

A command line tool to detect shared passwords List available modules: $ java -jar shard-1.0.jar -l Available modules: Facebook LinkedIn Reddit Twitter Instagram Given a username and password shard will attempt to authenticate with multiple sites: $ java -jar shard-1.0.jar -u -p - Tried credentia...

Secret: SSL Not Enforced

Although by default, all the communication in the Secret web app happens over HTTPS, if this is changed to HTTP, the requests are still normally processed. For example, the request to send a download link to a phone number can be as simple as POST //send-download-link HTTP/1.1 Host: www.secret.ly...

China APT Hackers Target Diplomats in Ke3chang Campaign

European diplomats and ministries of foreign affairs have been targeted during recent G20 meetings by Chinese-speaking hackers conducting espionage campaigns using malware to siphon secrets from compromised computers. The latest incidents came in August when spear phishing messages spiked with...

IBM WebSphere Application Server 'plugin-key.kdb' Information Disclosure Vulnerability

The host is running IBM WebSphere Application Server and is prone to information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbibmwaspluginkeyinfodiscvuln.nasl 5931 2017-04-11 09:02:04Z teissa $ IBM WebSphere Application Server 'plugin-key.kdb' Information Disclosure Vulnerability...

CVE-2004-2762

The server in IBM Tivoli Storage Manager TSM 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial of service daemon...

CVE-2004-2762: Undefined Security Weakness

The server in IBM Tivoli Storage Manager TSM 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial of service daemon...

Hydra: HTTP

This plugin runs Hydra to find HTTP passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...