CVE-2019-19633

CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...

CVE-2024-53591

CVE-2024-53591 Des: An issue in the login page of Seclore v3.27.5.0 allows attackers to enumerate valid domains internal service via a brute force attack. POC: https://company/policyserver/redirectTprepositoryEntryAction.do?repoCode=10006, brute force repoCode parameter to find all hosted domains...

JWT-Bruteforcer

JWT-Bruteforcer Basic Jwt Bruteforcer tool with CVE-2018-1000531 Vulnerability Test Imported libraries: jwt base64 Requires minimum version of python 3.6...

Zydra

Zydra Zydra is a file password recovery tool and Linux shadow file cracker. It uses the dictionary search or Brute force method for cracking passwords. Supported Files RAR Files Legacy ZIP Files PDF Files Linux Shadow Files zydra can find all the user’s password in the linux shadow file one after...

CredMaster

CredMaster Launch a password spray / brute force attach via Amazon AWS passthrough proxies, shifting the requesting IP address for every authentication attempt. This dynamically creates FireProx APIs for more evasive password sprays. Shoutout to @ustayready for his CredKing and FireProx tools,...

CVE-2024-24919

CVE-2024-24919 This project aims to create an automation to better study CVE-2024-24919. api.py : Collects possible vulnerable IPs. CVE-2024-24919.py : Performs brute force given the IP file and the directories file. worldListLFI.txt : List of Linux directories. Usage Clone this repository on you...

BruteX

BruteX ABOUT: Automatically brute force all services running on a target Open ports Usernames Passwords INSTALL: root@kitploit: ./install.sh USAGE: root@kitploit: brutex target DOCKER: root@kitploit: docker build -t brutex . docker run -it brutex target LICENSE:...

wetland

Wetland Wetland is a high interaction SSH honeypot，designed to log brute force attacks.What's more, wetland will log shell、scp、sftp、exec-command、direct-forward、reverse-forward interation performded by the attacker. Wetland is based on python ssh module paramiko. And wetland runs as a...

words-scraper

Words Scraper Web scraper basado en Selenium para generar listas de contraseñas. Instalación root@kitploit: Download Firefox webdriver from https://github.com/mozilla/geckodriver/releases $ tar xzf geckodriver-vVERSION-HERE.tar.gz $ sudo mv geckodriver /usr/local/bin Make sure it is in your PATH ...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE Race Condition Account Takeover Overview A race condition in the OAuth2 authorization server allows an attacker to reuse a victim’s authorization code before the legitimate client redeems it, by guessing or brute‑forcing the PKCE codeverifier within a small time...

CVE-2019-17525

CVE-2019-17525 D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1 A vulnerability found on login-in page of D-LINK ROUTER "DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1" which allows attackers to easily bypass CAPTCHA on login page by...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...

BruteShark

About What it can do Download Examples Usage BruteSharkDesktop BruteSharkCli Modules Architecture Contributing About BruteShark is a Network Forensic Analysis Tool NFAT that performs deep processing and inspection of network traffic mainly PCAP files, but it also capable of directly live capturin...

jmxbf

jmxbf - A brute force program to test weak accounts configured to access a JMX Registry Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniele Costa, daniele dot costa at nccgroup dot trust http://www.github.com/nccgroup/jmxbf Released under AGPL see LICENSE for...

ParamPamPam

ParamPamPam This tool for brute discover GET and POST parameters. Installation With Docker Install Docker root@kitploit: git clone https://github.com/Bo0oM/ParamPamPam.git cd ParamPamPam docker build -t parampp . echo -e '!'"/bin/bash\ndocker run -ti --rm parampp $@" /usr/local/bin/parampp paramp...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

kerbrute

Kerbrute Kerberos 事前認証を利用して、有効な Active Directory アカウントを高速にブルートフォースおよび列挙するためのツール 最新のバイナリは リリースページ から入手して始めてください。 背景 このツールは、数年前に Heimdal Kerberos クライアントを Linux から使ってブルートフォースを行うために作成した bash スクリプト から発展しました。Kerberos クライアントをインストールする権限を必要としないものを作りたいと考えていたところ、純粋な Go 実装の Kerberos ライブラリ gokrb5 に出会い、ついに Go...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit Brute-force Mitigation Bypass Exploit Code for CVE-2019-17240 aka Bludit = 3.9.2 Bruteforce Mitigation Bypass Exploit Links: ExploitDB-48942 PacketStorm Expected outcome: Discover login credentials, bypassing Brute-force Mechanism on host running Bludit =3.9.2...

CVE-2024-57610

Lack of Rate Limiting in Sylius v2.0.2 Vendor Homepage: https://sylius.com/ Steps to Reproduce 1.Navigate to https://store.sylius.com/login 2.Attempt multiple login requests using automated tools or scripts e.g., Burp Suite, cURL. 3.Observe that no rate limiting is applied, and requests are...

Sububy

Sububy Sububy is a one stop subdomain enumeration suite written in ruby, it focuses on accuracy and quality with the flexibility of accessing some modules individually without having to stick with the tool execution flow, allowing you to integrate it with your work flow. Sububy comes with nine...