WhatBreach

WhatBreach WhatBreach is an OSINT tool that simplifies the task of discovering what breaches an email address has been discovered in. WhatBreach provides a simple and effective way to search either multiple, or a single email address and discover all known breaches that this email has been seen i...

pwnedOrNot

OSINT Tool for Finding Passwords of Compromised Email Accounts Created by Lohitya Pushkar thewhiteh4t. Twitter - Blog Available| in| ---|---|--- BlackArch Linux| SecBSD| Tsurugi Linux | | pwnedOrNot works in two phases. In the first phase it tests the given email address using HaveIBeenPwned v3...

CVE-2026-100833

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

EUVD-2026-87853

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

iKy

Description | Installation | Website | Modules | Issues | Supporting iKy Description Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Video Demo Modules Installation You must install Redis and start it...

pwned

pwned A command-line tool for queryingTroy Hunt's Have I been pwned? service using the hibp Node.js module. Installation Download and install Node.js, then install pwned globally using npm: root@kitploit: npm install pwned -g Alternatively, you can run it on-demand using the npx package runner:...

steamer

Steamer Import, manage, search public dumps. Do you have massive amounts of CSV, .sql, .txt, that have credentials, passwords, and hashes inside? Use Steamer to manage them! Load them into a MongoDB database, and either use the console directly, or just use the handy web interface complete with...

XposedOrNot

XposedOrNot XposedOrNot XoN tool is to search an aggregated repository of xposed passwords comprising of 850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security. Screenshot What is Xposed Passwords? The main aim of this project is to give...

Whoisleak

Whoisleak 이 도구는 도메인을 등록한 이메일을 조회하고 해당 이메일이 데이터 유출에 노출되었는지 확인합니다. 설치 방법 root@kitploit: $ apt-get install nodejs-legacy $ pip install -r requirements.txt 사용 예 root@kitploit: python whoisleak.py -u securityattack.com.br 연락처 / 블로그 root@kitploit: Eddy Oliveira SecurityAttack...

leakdb

LeakDB LeakDB는 조직이 자체 내부 평문 "Have I Been Pwned"와 유사한 서비스를 구축하고 배포할 수 있도록 설계된 도구 세트입니다. LeakDB 도구 세트는 다중 테라바이트 규모의 유출 데이터 세트를 정규화, 중복 제거, 인덱싱, 정렬 및 검색할 수 있으며, 개별 사용자에게 대용량 파일을 배포할 필요가 없습니다. 정리된 후 LeakDB는 0.1초 이내에 수 테라바이트의 데이터를 검색할 수 있으며, LeakDB 서버는 명령줄 클라이언트나 모든 HTTP 클라이언트를 사용하여 쿼리할 수 있는 간단한 JSON...

h8mail

h8mail 은 다양한 침해 및 정찰 서비스 또는 Troy Hunt의 "Collection1"과 악명 높은 "Breach Compilation" 토렌트 같은 로컬 침해 데이터를 활용하는 이메일 OSINT 및 침해 헌팅 도구입니다. 📖 목차 목차 기능 API 사용법 사용 예제 감사 및 크레딧 관련 오픈 소스 프로젝트 🍊 기능 🔎 이메일 패턴 매칭 정규식, 다른 도구 출력에서 읽어오기에 유용 🌍 URL을 전달하여 페이지에서 이메일을 직접 찾고 타겟팅 💫 로컬 검색을 위한 느슨한 패턴 "john.smith", "evilcorp" 📦...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure

WP Directory Kit plugin for WordPress = 1.4.9 contains a sensitive information exposure caused by improper access control in wdkpublicaction AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles. id: CVE-2025-13920 info: name: WP...

Contest Gallery - Broken Access Control

Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

mosint

기능 • 설치 • 서비스 • 사용법 • Docker • 설정 • 화면 Mosint은 Go로 작성된 자동화된 이메일 OSINT 도구로, 대상 이메일을 빠르고 효율적으로 조사할 수 있게 해줍니다. 여러 서비스를 통합하여 보안 연구자들이 풍부한 정보에 신속하게 접근할 수 있도록 합니다. 기능 빠르고 간단한 이메일 기반 스캐닝 사용 편의성 최적화 및 가벼운 리소스 사용 이메일 확인 및 검증 소셜 미디어 계정 확인 데이터 유출 및 비밀번호 유출 확인 관련 이메일 및 도메인 찾기 Pastebin 덤프 스캐닝 Google 검색 DNS/IP...