CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

Microsoft365_devicePhish

Microsoft365devicePhish Злоупотребление потоком авторизации OAuth Microsoft 365 для фишинговой атаки Это простой proof-of-concept скрипт, который позволяет атакующему провести фишинговую атаку на поток авторизации OAuth Microsoft 365. С его помощью можно подключиться к конечным точкам OAuth API...

TokenUniverse

Token Universe Token Universe — это продвинутый инструмент для экспериментов и исследования механизмов безопасности Windows. Он предоставляет интерфейс для создания, просмотра, олицетворения и изменения токенов доступа, запуска процессов, управления локальной службой безопасности, проверки...

TokenTactics

TokenTactics Azure JSON Web Token "JWT" — набор инструментов для манипуляции Токены доступа Azure позволяют аутентифицироваться на определённых конечных точках от имени пользователя, вошедшего с помощью кода устройства, даже если он использовал многофакторную аутентификацию. Получив токен доступа...

shhgit

🚨 shhgit is no longer maintained. If you need support or consultation for your secret scanning endeavours, drop me an e-mail [email protected] 🚨 shhgit helps secure forward-thinking development, operations, and security teams by finding secrets across their code before it leads to a security...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

AzureRT

AzureRT Модуль PowerShell, реализующий различные командлеты для взаимодействия с Azure и Azure AD с точки зрения атакующего. Полезные утилиты для работы с аутентификацией на основе маркеров доступа, переключения между интерфейсами Az, AzureAD и az cli, готовые к использованию атаки, такие как...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

askWAM

askWAM askWAM은 Windows WAMWeb Account Manager을 통해 Microsoft Entra 액세스 토큰을 자동으로 요청합니다. .NET Framework 클라이언트, 독립 실행형 네이티브 x64 클라이언트, 그리고 CNA 명령 어댑터가 포함된 x64 Beacon Object File로 제공됩니다. 모든 프런트엔드는 클라이언트에 표시되는 계정을 열거할 수 있으며, 불투명한 WAM 계정 ID 또는 정확한 사용자 이름으로 ID를 지정할 수 있습니다. 대화형 인증으로 폴백하는 경우는 없습니다. 이 흐름을 통...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

SlackPirate

SlackPirate - Инструмент для перечисления и извлечения данных из Slack Это инструмент, разработанный на Python, который использует нативные Slack API для извлечения «интересной» информации из рабочего пространства Slack при наличии токена доступа. По состоянию на май 2018 года у Slack более 8...

CVE-2026-51954

제품: Webasyst Framework 영향을 받는 버전: ≤ 4.0.3 심각도: 높음 CVSS 3.1: 8.0 설명 Webasyst Framework 4.0.3 이하에는 OAuth 2.0 구현 결함이 존재하며, 이로 인해 원격의 비인증 공격자가 OAuth 흐름 중에 발급된 인증 자격 증명을 가로챌 수 있습니다. 피해자는 일반적인 인증 승인 외에 추가로 어떤 조치를 취할 필요가 없습니다. 부적절한 검증으로 인해 공격자는 영구적인 API 액세스 토큰을 획득하고, 피해자의 전체 Webasyst 계정에 대해 완전하고 제한 없는 A...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

remote-control

Laravel용 Remote Control 자격 증명을 공유하지 않고 사용자 계정에 대한 원격 액세스를 부여합니다. 설치 구성 사용법 라우팅 원격 액세스 생성 생성된 액세스 토큰 사용 설치 Remote Control은 composer를 통해 설치할 수 있습니다: composer require "katsana/remote-control" 구성 이 패키지는 서비스 프로바이더를 자동으로 등록합니다. 다음으로, Remote Control 구성 파일을 게시해야 합니다: php artisan vendor:publish...

EUVD-2026-78653

Vikunja: TOTP secret is readable after enrollment, no step-up auth...

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

gato

!WARNING This repository is deprecated and archived Gato has been superseded by Trajan , Praetorian's multi-platform CI/CD vulnerability detection and attack automation tool. Trajan consolidates GitHub Actions Gato and GitLab Glato CI/CD attack capabilities into a single, actively-maintained...