Bcrypt-forcer

Bcrypt-forcer sqlmap Bcrypt 解密工具 Bcrypt 哈希破解器。...

hello-ReGrade-security

hello-ReGrade-security 一个动手实践的演示，展示如何用 ReGrade 进行零日漏洞发现 。 你将把一套普通测试套件指向 ReGrade，让它针对一个小型服务录制流量，再对同一服务的第二个副本 重放 ，然后用 Claude Code + ReGrade MCP 工具 暴露一个密码哈希泄露 ——一个没有任何测试是为发现它而编写的漏洞。 它模拟了一个真实 bug：CVE-2023-5968 ，一个协作平台的用户名更新端点返回了完整用户对象， 包括 bcrypt 密码哈希 。该漏洞于 2017 年上线，存活了 7 年，躲过了测试、审查和审计。Curtail 的博客文章。...

hmac-bcrypt

hmac-bcrypt This repository contains reference implementations of the hmac-bcrypt password hashing function in several languages. Each reference implementation attempts to be a 1:1 port of the original C and Perl implementations created by @epixoip where possible, and are fully compatible with ea...

CVE-2026-8794

CVE-2026-8794 — PaperCut NG 中通过认证时序侧信道进行的用户名枚举 字段| 详情 ---|--- CVE ID| CVE-2026-8794 产品| PaperCut NG 受影响版本| 25.0.11（Build 75758）及更早版本 CWE| CWE-208 — 可观察的时序差异 CVSS 分数| 3.7（低）— 单独使用时；与 CVE-2026-8793 链式利用时升级 研究人员| Vivien LEBAS（@Hazaz） 报告时间| 2026 年 5 月 状态| 已修复 — PaperCut NG 26.0.3 摘要 PaperCut NG...

xbootEncodePwd

xbootEncodePwd root@kitploit: xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT...

CVE-2026-25050

CVE-2026-25050 – 身份验证时序攻击 本仓库包含一个概念验证（PoC），演示了影响 NativeAuthenticationStrategy.authenticate 方法的时序攻击。 该 PoC 作为博客/研究用途的技术演示 提供。 漏洞 当用户不存在时，身份验证逻辑会立即返回，而当用户存在时，则会执行开销较大的密码哈希验证。 root@kitploit: const user = await this.userService.getUserByEmailAddressctx, data.username; if !user return false; const...

HTB-Pterodactyl-Writeup

HackTheBox — Pterodactyl Writeup Difficulty: Medium | OS: Linux openSUSE Leap 15.6 | Season: 10 Summary Pterodactyl is a medium-difficulty Linux machine running the Pterodactyl game server panel. The attack chain involves an unauthenticated LFI-to-RCE vulnerability in the panel, credential...

cve-2022-22976-bcrypt-skips-salt

Comprobación de Hash BCrypt Para ayudar con los pasos de mitigación de CVE-2022-xxxx, puede utilizar esta herramienta para revisar su base de datos en busca de hashes que necesiten actualizarse. Después de haber integrado la aplicación con su base de datos, la herramienta funciona en dos pasos...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

CVE-2026-75112

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

EUVD-2026-62694

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...