WPForce

WPForce - Wordpress Attack Suite ABOUT: WPForce is a suite of Wordpress Attack tools. Currently this contains 2 scripts - WPForce, which brute forces logins via the API, and Yertle, which uploads shells once admin credentials have been found. Yertle also contains a number of post exploitation...

WPCracker

WPCracker WordPress user enumeration and login Brute Force tool for Windows and Linux With the Brute Force tool, you can control how aggressive an attack you want to perform, and this affects the attack time required. The tool makes it possible to adjust the number of threads as well as how large...

domain

概述 Recon-ng 和 Alt-DNS 很棒。这个脚本结合了这些工具的强大功能，并能在同一会话中运行多个域名。 TL;DR：我只想通过一条命令完成子域名发现，然后搞定。 只有一个模块需要API密钥（/api/googlesite），在recon-ng维基上可以找到相关说明。 该脚本利用recon-ng枚举子域名。使用Google抓取、Bing抓取、百度抓取、Yahoo抓取、Netcraft和暴力破解来查找子域名。此外，还能解析为IP地址。 前置条件 从源码安装recon-ng 1. 克隆Recon-ng仓库 git clone...

zenbuster

About ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin @0xTas. I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity tooling in general. ZenBuster may not be the fastest or most...

Dagon

Dagon - 高级哈希操作 以地狱王子命名的 Dagon day-gone 是一个高级哈希破解与操作系统，能够暴力破解多种哈希类型、创建暴力破解字典、自动验证哈希算法、从 Unicode 到 ASCII 的随机盐值生成，以及更多功能。 截图 暴力破解变得简单：如果您未指定词表，内置词表创建器将生成 100,000 个字符串供使用 验证用于创建您正在尝试破解的哈希的算法。可以通过提供 -L 标志来查看所有可能的算法（部分算法尚未实现） 随机加盐、Unicode 随机加盐，或者您也可以自行选择盐值。 演示视频 下载 您可以通过 git clone...

CVE-2022-36539

CVE-2022-36539 Insecure Direct Object Reference IDOR WeDayCare B.V. WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children. Traffic with the API is made transparent via a proxy such as Burp Suite...

dnsx

Un conjunto de herramientas DNS rápido y multipropósito diseñado para ejecutar consultas DNS Características • Instalación • Uso • Ejecutar dnsx • Wildcard • Notas • Unirse a Discord dnsx es un conjunto de herramientas DNS rápido y multipropósito diseñado para ejecutar diversas sondas a través de...

jwt-cracker

jwt-cracker Simple cracker de fuerza bruta para tokens JWT HS256, HS384 y HS512. Efectivo solo para vulnerar tokens JWT con secretos débiles. Recomendación : utiliza secretos largos y fuertes o tokens RS256. Instalación Con npm: root@kitploit: npm install --global jwt-cracker Uso Desde la línea d...

jwt-cracker

jwt-cracker Simple HS256, HS384 & HS512 JWT token brute force cracker. Effective only to crack JWT tokens with weak secrets. Recommendation : Use strong long secrets or RS256 tokens. Install With npm: root@kitploit: npm install --global jwt-cracker Usage From command line: root@kitploit:...

mec

mec MassExploitConsole Destinado a la explotación masiva Sigue lawiki para comenzar Características Interfaz CLI fácil de usar Ejecuta exploits adaptados con concurrencia a nivel de procesos Exploits integrados automatizados Oculta tu IP usando proxychains4 y proxypool Escaneo de hosts ZoomEye 10...

shuffledns

Wrapper de massDNS para realizar fuerza bruta y resolución de subdominios con soporte para manejo de comodines Características • Instalación • Ejecución • Comodín • Licencia • Discord shuffleDNS es un wrapper alrededor de massdns, escrito en Go, que permite enumerar subdominios válidos mediante...

pixiewps

概要 Pixiewps はC言語で書かれたツールで、一部のソフトウェア実装における低エントロピーまたはエントロピー欠如を利用してWPS PINをオフラインでブルートフォースする ためのものです。これは、2014年夏にDominique Bongardによって発見された、いわゆる「ピクシーダスト攻撃」です。教育目的のみを意図しています。 ReaverやBullyなどのツールで実装されている従来のオンラインブルートフォース攻撃（PINを数時間で回復することを目的とする）とは対照的に、この方法は、ターゲットによっては、脆弱な場合 、わずか数秒 または数分 でPINを取得できます。...

CVE-2021-46366

CVE-2021-46366: Credential Bruteforce Attack via CSRF + Open Redirect in Magnolia CMS An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery CSRF in order to brute force and exfiltrate users'...

SAP-brute

SAP-brute SAP Netweaver Login Bruteforcer. root@kitploit: usage: SAP-brute.py -h -u URL -f FILE -p PROXY optional arguments: -h, --help show this help message and exit -u URL, --url URL URL to test -f FILE, --file FILE File of urls -p PROXY, --proxy PROXY Proxy for debugging Single Site...

enumdb

enumdb Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search fo...

CVE-2025-48461

CVE-2025-48461 Predictable session cookies that can be bruteforced to gain unauthorized access to Advantech WISE portal Summary During examination of Advantech WISE-4060 web portal, I have discovered that the session cookies used to authenticate to the web portal follows the pattern 60D01EXXXXX...

PassBreaker

PassBreaker PassBreaker is a command-line password cracking tool developed in Python. It allows you to perform various password cracking techniques such as wordlist-based attacks and brute force attacks. Features Wordlist-based password cracking Brute force password cracking Support for multiple...

Sublist3r

Acerca de Sublist3r Sublist3r es una herramienta de Python diseñada para enumerar subdominios de sitios web utilizando OSINT. Ayuda a los probadores de penetración y cazadores de bugs a recolectar y reunir subdominios para el dominio que están atacando. Sublist3r enumera subdominios utilizando...

CVE-2016-10924

CVE-2016-10924 CVE-2016-10924 - Directory traversal vulnerability in WordPress ebook-download plugin1.2. PoC + PID Bruteforce in Python. Usage root@kitploit: git clone https://github.com/rvizx/CVE-2016-10924 cd CVE-2016-10924 python pidbrute.py...

adfsbrute

adfsbrute Un script para probar credenciales contra Active Directory Federation Services ADFS, calculando la URL de ADFS de una organización y permitiendo ataques de password spraying o fuerza bruta. La idea principal es realizar ataques de password spraying con una demora aleatoria y alta entre...