D-Link-CVE-2021-27342-exploit

D-Link-CVE-2021-27342-exploit Exploit for CVE-2021-27342 vulnerability telnet authentication brute-force protection bypass...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/flaskapp.py CWE: CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS 3.1:...

wargame-turkey_in_2

wargame 1. flag file divide 2. Brute force prevent - delay 50005s 3. logging 4. password hashing -wargame-turkeyin2...

cve-2017-7921-golang

Hikvision bypass exploit Requirements 1. github.com/levigross/grequests 2. github.com/msterzhang/gpool 3. golang.org/x/net 4. github.com/go-vgo/robotgo Build root@kitploit: git clone https://github.com/MisakaMikato/cve-2017-7921-golang.git cd cve-2017-7921-golang/src/cve-2017-7921-golang go build...

web-brutator

Web Brutator 高速モジュラーWebインターフェースブルートフォーサー 📥 インストール root@kitploit: python3 -m pip install -r requirements.txt ⏩ 使い方 root@kitploit: $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ / // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /|...

patator

Patator Patator 的诞生源于使用 Hydra、Medusa、Ncrack、Metasploit 模块和 Nmap NSE 脚本进行密码猜测攻击时的挫败感。我选择了一种不同的方法，以避免再次创建另一个暴力破解工具并重复相同的缺陷。Patator 是一个用 Python 编写的多线程工具，力求比其前辈更可靠、更灵活。 目前它支持以下模块： ftplogin : Brute-force FTP sshlogin : Brute-force SSH telnetlogin : Brute-force Telnet smtplogin : Brute-force SMTP...

CVE-2023-5561-POC-Updated

CVE-2023-5561-POC-Updated This repository contains a modified version of the original Proof-of-Concept PoC for CVE-2023-5561. The original PoC, which can be found here, sends a high volume of requests in parallel, which may trigger Web Application Firewalls WAFs or cause the server to block the...

solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

CVE-2026-55795

Craft Commerce (an ecommerce plugin for Craft CMS) is affected by a rate-limit bypass in CartController (src/controllers/CartController.php). The RateLimiter behavior activates only when the number POST/GET parameter is present. An unauthenticated attacker can omit number while submitting couponC...

CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

CVE-2017-7921

CVE-2017-7921 Hikvision unauthorized access detection poc and password detection Usage： root@kitploit: Usage: -a 加载Poc模块 -b 加载密码爆破模块 -e 加载Exp模块 -f string 文件名称 默认为空 -i string 输入ip地址 eg:192.0.0.1-192.0.0.255 -p string 密码 default:12345 default "12345" -s string 协议 eg:http default "http" -t int 线程数量...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 This repository contains a Proof of Concept PoC script for exploiting a privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000 , allows unauthenticated users to gain...

wp-def

wp-def WordPress 默认用户 + 密码 Python 2.7 请我喝咖啡： 比特币 $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 如何使用？ 安装 Python 2.7 在此下载 python file.py...

CodeIgniterXor

CodeIgniterXor PoC script to decode CodeIgniter = 2.1.4 session cookies that use xorencode method. Full details availalbe on on the following blog post: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Usage break.py This is the main script, and given a target URI will...

CVE-2024-28000-Exploit-Lab

CVE-2024-28000 — WordPress LiteSpeed Cache Lab Authorized local-lab reproduction of CVE-2024-28000 , an unauthenticated privilege-escalation issue affecting vulnerable versions of the LiteSpeed Cache WordPress plugin. Scope: This repository documents testing performed only against an isolated,...

pritunl-CVE-2020-25200

CVE-2020-25200 Pritunl VPN server - Affected version: Pritunl v1.29.2145.25 553bbd ========================= Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username i...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...