OWA-Password-Sprayer

OWA-Password-Sprayer OWA Password Sprayer This Python script facilitates password spraying against Outlook Web Access OWA endpoints. Password spraying is a technique used to test a single password against multiple usernames, aiming to find valid credentials for accessing the OWA. Features: Suppor...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

CVE-2023-4800

ID de CVE: CVE-2023-4800 Tipo de Vulnerabilidad: Exposición de datos sensibles Descripción: El plugin DoLogin Security para WordPress es vulnerable al acceso no autorizado de datos debido a una verificación de capacidad faltante en el widget del panel de administración en versiones hasta la 3.7...

Cartero

Cartero URL http://section9labs.github.io/Cartero/ Description A robust Phishing Framework with a full featured CLI interface. The project was born out necessity through of years of engagements with tools that just didn't do the job. Even though there are many projects out there, we were not able...

EEF-CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server...

CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server sponsors...

EEF-CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server...

EUVD-2026-72147

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-82751

CVE-2026-82751 affects the ZenHive mpp library (Elixir), specifically MPP.Methods.Tempo.FeePayerPolicy.measure/3, in versions 0.2.0 through 0.16.0 . The function bounds gas fields, fee budgets, validity windows, and access lists of the client-signed 0x76 envelope but fails to check the optional k...

waybackpack

waybackpack Waybackpack is a command-line tool that lets you download the entire Wayback Machine archive for a given URL. For instance, to download every copy of the Department of Labor's homepage through 1996 which happens to be the first year the site was archived, you'd run: root@kitploit:...

cve-2024-34351-demo

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for demonstrating CVE-2024-34351 -- a Server-Side Request Forgery SSRF vulnerability in Next.js Server Actions. Discovered by Adam Kues and Shubham Shah at Assetnote. Fixed in Next.js 14.1.1. How the vulnerability works When a Server Action...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

CVE-2023-43144

CVE-2023-43144 Description Assets Management System 1.0 is vulnerable to SQL injection via the id parameter in delete.php PoC root@kitploit: sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch Code review delete.php root@kitploit: ?php include...

CVE-2025-50361

Desbordamiento de Búfer Global en SmallBASIC SmallBASIC es un intérprete del lenguaje BASIC rápido y fácil de aprender, ideal para cálculos cotidianos, scripts y prototipos. SmallBASIC incluye funciones trigonométricas, matriciales y de álgebra, un IDE integrado, una potente biblioteca de cadenas...

Pentest-Bookmarkz

Pentest Bookmarks List Sofiane Hamlaoui Ver más en Google : https://g.co/kgs/FUZgoXi Medios Hacker Blogs Hay MUCHOS blogs de pentesting, estos son los que monitoreo constantemente y valoro en el trabajo de pruebas del día a día. Carnal 0wnage - atom McGrew Security GNUCITIZEN Darknet - The...

CVE-2025-8088

Inmersión Técnica: CVE-2025-8088 - El Recorrido de Ruta Resiliente Descargo de responsabilidad: Este contenido es solo para fines educativos y de investigación. No utilice esta información para actividades maliciosas. Hoy realizamos una inmersión profunda en una fascinante vulnerabilidad de...

MIPS-CVE-2014-9222

Disclaimer Tutorials are for informational and educational purposes only. I believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. I believe that it is impossible to defend yourself from hackers without...

applepie

applepie, a hypervisor implementation for Bochs Hello! Welcome to applepie! This is a tool designed for fuzzing, introspection, and finding bugs! This is a hypervisor using the Windows Hypervisor Platform API present in recent versions of Windows specifically this was developed and tested on...

LdapRelayScan

LDAP Relay Scan A tool to check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication. If you're interested in the specifics of the error-based enumeration, see below. For details regarding what can be done when you identify a lack of LDAP protections, see the...