email-osint-ripper

email-osint-ripper EO-RIPPER.PY는 이메일 또는 이메일 목록에 대해 OSINT를 수행하는 완벽한 도구입니다. 다양한 기능을 제공하며 목표에 대한 많은 정보를 얻을 수 있습니다. 비디오 https://www.youtube.com/watch?v=Eo9mJLBc2c&t=254s https://www.youtube.com/watch?v=0lJ6iD2x72o&t=144s EO-RIPPER 사용 방법? Linux 운영 체제를 권장하지만, Python 3와 라이브러리만 필요합니다: 라이브러리 re, json,...

s3-account-search

S3 계정 검색 이 도구는 S3 버킷이 속한 계정 ID를 찾을 수 있게 해줍니다. 이 도구를 사용하려면 다음 권한 중 하나 이상이 필요합니다: 버킷에서 알려진 파일을 다운로드할 수 있는 권한 s3:getObject. 버킷의 내용을 나열할 수 있는 권한 s3:ListBucket. 또한, 검사 중인 버킷에 대해 이러한 권한중 하나을 가지고 역할을 맡을 수 있는 역할이 필요합니다. 더 자세한 배경은 Cloudar 블로그에서 확인할 수 있습니다. 설치 이 패키지는 pypi에서 사용할 수 있습니다. 예를 들어 다음 명령어 중 하나를 사...

seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

whatsapp-census

こんにちは！あなたは WhatsApp を使っています これは、論文 こんにちは！あなたは WhatsApp を使っています：セキュリティとプライバシーのための30億アカウントの列挙 の拡張版の GitHub リポジトリです。 概要 WhatsApp は、2025年初頭の時点で35億のアクティブアカウントを抱える、世界最大のインスタントメッセージングプラットフォームです。 その膨大なユーザーベースを考慮すると、WhatsApp は世界のコミュニケーションにおいて極めて重要な役割を果たしています。...

Stalker

Stalkerとは 非常にシンプルで、おそらく雑に書かれたOSINTツールです。単一のユーザー名を複数のWebサイトで素早く検索できます。 時間を節約することを目的としており、シンプルさを保ちたかったので、すべてが単一の乱雑な.pyファイルにまとめられています。近いうちにこれを少し整理しようと思っています。 使い方 まず、このリポジトリをクローンします： git clone https://gitlab.com/Pxmme/stalker Python3やpip3がインストールされていない場合は、それらをインストールします： apt-get update apt-get install...

blackbird

Blackbird ユーザー名によるアカウント検索を574サイトで高速に行うOSINTツール ロッキードSR-71 "Blackbird"は、アメリカの航空宇宙企業ロッキード社が開発・製造した長距離・高高度・マッハ3以上の戦略偵察機です。 免責事項 root@kitploit: This or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that me P1ngul1...

CVE-2025-13166

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

EUVD-2025-210911

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166

WSO2 Identity Server is affected by a username enumeration vulnerability in its SMS OTP flow . The root cause is that the OTP initiation process returns differing error messages depending on whether the queried account exists and has a mobile number configured, allowing an attacker to infer valid...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2025-5802 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use...

CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

PT-2026-57844

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and...

Devolutions Server <= 2026.1.21 / 2026.2.0 <= 2026.2.5 Multiple Vulnerabilities (DEVO-2026-0017)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.21 or 2026.2.0 prior or equal to 2026.2.5. It is, therefore, affected by multiple vulnerabilities, including: - Improper access control in PAM account discovery results in Devolutions Server 2026.2.5,...