Lucene search
+L

11607 matches found

Kitploit
Kitploit
added 2026/09/10 7:38 p.m.8 views

CacheData_decrypt

CacheDatadecrypt Un simple kit de herramientas para hacer fuerza bruta y descifrar el CacheData de Windows EntraId. root@kitploit: usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as...

5.9AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 6:46 p.m.8 views

HQLmap

HQLMap 本项目旨在利用HQL注入漏洞。 该工具使用Python编写,并在MIT许可证下发布。 未来开发:我计划为SQLmap开发专用模块。 在哪里可以尝试该工具? 如果你想要一个快速易受攻击的环境来尝试该工具,我推荐使用RopeyTasks: https://github.com/continuumsecurity/RopeyTasks/ 此外,如果你想要更多关于HQLi的信息,请查看这篇博客文章: http://blog.h3xstream.com/2014/02/hql-for-pentesters.html 安装 要安装此项目,只需通过以下命令克隆该项目:...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 6:42 p.m.12 views

awind-research

Awind 研究 本仓库收录了与我所开展的研究相关的各类有用资料,该研究针对 Awindinc 制造并贴牌(OEM)给多家厂商的无线演示设备。 该仓库分为以下几个子部分: hardware - 硬件破解相关内容,主要用于 MMC 转储和引脚定义文档 networking - PIN 码暴力破解器、自定义 Nmap 脚本和指纹 exploits - Metasploit 模块和基于 Python 的漏洞利用程序。 受影响设备 以下设备均由 Awind 贴牌生产,因此受相同问题影响。 Crestron Airmedia AM-100 Crestron Airmedia AM-101...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 6:21 p.m.11 views

AI-PASSWORD-TESTING-AGENT

AI Password Attack Orchestrator - Defensive Research Repository ⚠️ LEGAL DISCLAIMER & RESEARCH PURPOSE THIS REPOSITORY IS FOR DEFENSIVE CYBERSECURITY RESEARCH AND EDUCATIONAL PURPOSES ONLY NO EXPLOITABLE CODE - This repository contains only theoretical research, conceptual analysis, and defensive...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 4:40 p.m.10 views

CVE-2019-9053

この修正はhttps://tryhackme.com/room/easyctfによるものです : お楽しみください 修正された重大な問題 1. Python 2からPython 3への互換性 旧: print "string" 新: print"string" すべてのprint文をprint関数に変更 文字列フォーマットをf-stringに更新 2. 非推奨のoptparseライブラリ 旧: import optparse 新: import argparse オプション解析システム全体をモダンなargparseに置き換え 適切なヘルプテキストとデフォルト値を追加 3...

8.1CVSS7.5AI score0.68581EPSS
SaveExploits38
Kitploit
Kitploit
added 2026/09/10 9:35 a.m.10 views

CVE-2025-10658

Exploit: SupportCandy 访客 OTP 暴力破解 → 账户接管 1 发起 OTP 登录流程(浏览器) 打开: root@kitploit: /support/ 选择 访客 / OTP 登录 输入目标邮箱(例如 [email protected]) 提交 2 从 OTP 表单中提取所需值 在 DevTools → Network → admin-ajax.php?action=wpscauthenticateguestlogin 响应中: root@kitploit: 保存: OTPID NONCE 3 暴力破解 OTP root@kitploit:...

6.5CVSS6AI score0.00338EPSS
SaveExploits0
NVD
NVD
added 2026/09/10 8:17 a.m.11 views

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

6.5CVSS0.00213EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 7:18 a.m.12 views

EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

6.5CVSS5.6AI score0.00213EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 7:18 a.m.39 views

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

6.5CVSS5.6AI score0.00213EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 7:18 a.m.35 views

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

6.5CVSS0.00213EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/10 7:18 a.m.13 views

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

6.5CVSS5.6AI score0.00213EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 7:18 a.m.10 views

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 针对 Sliver C2 的 HTTPS 监听器的拒绝服务攻击利用工具。通过暴力破解每个会话的 PNG 编码随机数,并投递一个解压炸弹来耗尽服务器内存。 已发布为 GHSA-663m-7x7m-g4fw。 概述 Sliver 的 HTTPS C2 通道将消息封装在 PNG 图像中。每个会话被分配一个范围在 1, 65537 内的随机随机数,服务器仅解码那些 ?n= 查询参数与会话随机数匹配的请求中的 PNG 数据。这是一种路由机制,而非身份验证检查——密钥空间仅为 16 位。 服务器使用 Go 的 image.Decode 解码...

5.9AI score
SaveExploits0References1
NVD
NVD
added 2026/09/10 7:17 a.m.12 views

CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

7.5CVSS0.0019EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/10 6:36 a.m.9 views

FTPBuster

FTPBuster FTPBuster is a powerful command-line brute-forcing tool designed to brute-force FTP, SFTP, and explicit FTPS servers by performing dictionary-based attacks. It is intended for ethical hacking and penetration testing Features Brute-force support for FTP , SFTP , and explicit FTPS AUTH TL...

6AI score
SaveExploits0
EUVD
EUVD
added 2026/09/10 6:00 a.m.10 views

EUVD-2026-75264

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

7.5CVSS5.7AI score0.0019EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/10 5:34 a.m.10 views

SecureOps-Lab

SecureOps Lab - ライブサイバーセキュリティ評価 概要 大学のLinuxサーバーに対してライブサイバーセキュリティ評価を実施しました。分析中に、ブルートフォース認証試行やLog4Shell(CVE-2021-44228)を標的とした悪用試行を含む、アクティブな攻撃活動が特定されました。 「協調IP」とは、同じサブネットから発信される複数の悪意のあるIPアドレスを指し、共有された攻撃インフラストラクチャや自動化された攻撃ツールが同時にシステムを標的としていることを示しています。 脅威分析と発見事項 ブルートフォース攻撃 単一の外部IPから144回のSSHログイン失敗を検出...

10CVSS7.6AI score0.99999EPSS
SaveExploits370
Kitploit
Kitploit
added 2026/09/10 3:40 a.m.9 views

CVE-2026-44596

CVE-2026-44596 — YAMCS 认证端点缺少速率限制 概述 yamcs-core 中的认证端点 POST /auth/token 缺乏任何形式的速率限制、帐户锁定或失败尝试节流。未认证的远程攻击者可以对任何用户帐户执行无限制的密码猜测尝试。 字段| 值 ---|--- CVE| CVE-2026-44596 严重程度| MEDIUM CVSS 5.3 CWE| CWE-307: 对过多认证尝试的限制不当 受影响版本| yamcs-core = 5.12.7。 时间线 日期| 事件 ---|--- 2026-05| 漏洞报告 2026-05-27| 在 yamcs-core...

9.8CVSS6.2AI score0.0206EPSS
SaveExploits3References2
Kitploit
Kitploit
added 2026/09/10 1:40 a.m.12 views

CVE-2026-7671

CVE-2026-7671 - Tornet 滑板车 OTP 暴力破解 摘要 Tornet 滑板车移动应用 4.75(Android 版)中存在对过多身份验证尝试的限制不当问题(CWE-307)。 详情 /TwoFactor 端点未实施速率限制或锁定机制。 4 位 OTP(0000-9999)可被远程暴力破解。 时间线 2025-10-24:已通知供应商 2026-04-08:公开披露(未收到供应商回应) 2026-05-02:分配 CVE-2026-7671 参考 https://vuldb.com/?id.360819...

6.3CVSS5.5AI score0.00565EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 1:37 a.m.10 views

CVE-2025-56224

CVE-2025-56224(OTP)验证绕过 描述 攻击者可以冒充其他用户的手机号码,并利用此漏洞在不知道 OTP 验证码的情况下验证该号码。 CVSS 评分:8.1(高危) 攻击类型 远程(已认证) 受影响版本 8.6.8 及之前的版本 产品供应商 Ascertia 受影响产品代码库 SigningHub 受影响组件 手机号码验证功能。 缓解措施 如果尝试次数超过一定值,则撤销 OTP 验证码。 漏洞详情 该应用程序未对一次性密码(OTP)验证端点实施适当的速率限制。这允许攻击者在不受限制的情况下自动化并暴力破解 OTP 验证码。通过快速连续发送大量 OTP...

8.1CVSS6AI score0.00363EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/10 1:37 a.m.22 views

CVE-2025-56221

CVE-2025-56221 对过多身份验证尝试的限制不当 描述 攻击者可以进行无限制的身份验证尝试,从而增加通过密码猜测来入侵目标用户账户的风险。 CVSS 评分:7.5(高危) 攻击类型 远程(已认证) 受影响版本 版本 8.6.8 发现者: Yazan Abu-Nadi...

9.8CVSS6AI score0.00561EPSS
SaveExploits0
Rows per page
Query Builder