MSOLSpray

MSOLSpray 一款针对 Microsoft Online 帐户（Azure/O365）的密码喷洒工具。该脚本会记录用户凭据是否有效、帐户是否启用 MFA、租户是否存在、用户是否存在、帐户是否被锁定，以及帐户是否被禁用。 请务必小心，避免锁定帐户！ 为什么又做一款喷洒工具？ 是的，我知道还有其他针对 O365/Azure 的密码喷洒工具。本工具的主要区别在于，它不仅寻找有效密码，还能获取 Azure AD 错误代码中极为详细的信息。这些错误代码可以提供以下信息：帐户是否启用 MFA、租户是否存在、用户是否存在、帐户是否被锁定、帐户是否被禁用、密码是否已过期，以及更多信息。...

ProtOSINT

ProtOSINT ProtOSINT 是一个 Python 脚本，帮助您调查 Proton Mail 账户。 版本 这是 ProtOSINT v2 。第一版已经存在好几年了，但 Proton 的 API 发生了变化，旧的检查方法不再有效，因此此次重写使该工具重获新生。衷心感谢 NeutrOSINT 在此期间持续进行此类研究。 描述 本工具专为 Proton Mail 的 OSINT 工作设计（仅限教育和授权用途）。您提供一个电子邮件地址、用户名或域名，它会告诉您能发现什么：该地址是否真实存在、账户的加密密钥创建时间、使用的算法，以及自定义域名是否托管在 Proton 上。 它包含四个模...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

Bluto

BLUTO Reconocimiento DNS | Fuerza Bruta | Transferencia de Zona DNS | Verificaciones de Comodín DNS | Fuerza Bruta de Comodín DNS | Enumeración de Correos Electrónicos | Enumeración de Personal | Enumeración de Cuentas Comprometidas | Cosecha de MetaDatos Autor: Darryl Lane | Twitter:...

sherlock

通过用户名在 400+ 社交网络中搜索社交媒体账号 安装 • 使用方法 • 贡献 安装 !WARNING 由第三方维护的 ParrotOS 和 Ubuntu 24.04 软件包似乎已损坏。 这些系统的用户应使用 uv/pipx/pip 或 Docker。 方法| 备注 ---|--- pipx install sherlock-project| 可使用 pip 或 uv 代替 社区维护的软件包可用于 Debian = 13、Ubuntu = 22.10、Homebrew、Kali 和 BlackArch。这些软件包不由 Sherlock Project 直接支持或维护。...

sterraxcyl

- S T E R R A - Una herramienta SOCMINT única para obtener información sobre una cuenta de Instagram a partir de sus seguidos | seguidores...

Scythe

Scythe scythe：账户枚举器 root@kitploit: 账户枚举器的设计目的是简化账户枚举操作， 使其成为安全测试的一部分。该框架提供了轻松创建新模块 （XML 文件）并加快测试过程的能力。 该工具的创建主要基于两个用例： - 能够在一系列网站（例如 社交媒体、博客平台等）上测试一系列电子邮件地址，以找到这些目标 在哪些网站拥有活跃账户。这在社会工程测试中很有用， 当你拥有某公司的电子邮件账户，并希望列出这些用户 将工作邮箱用于哪些第三方网络服务时。 - 能够快速创建自定义测试用例模块，并使用它来枚举 一组活跃账户。可使用已知用户名、电子邮件地址列表 或常见账户名字典。...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

SSH-account-enumeration-verification-script

SSH-account-enumeration-verification-script Script de verificación de enumeración de cuentas SSH CVE-2018-15473...

CVE-2026-85210

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

EUVD-2026-70488

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

EUVD-2026-68098

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

JetBrains YouTrack < 2026.2.18112 Information Disclosure (CVE-2026-75046)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18112. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could enumerate accounts via the users search endpoint. CVE-2026-75046 Note that Nessus has not tested for this...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

EUVD-2026-60245

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75046

JetBrains YouTrack before 2026.2.18112 has an authenticated user enumeration flaw in the users search endpoint, allowing account discovery (CVSS 4.3 MEDIUM). No exploitation details are provided; upgrade to 2026.2.18112 or later. Monitor JetBrains issue tracker for further advisories.