TP-Link-defaults

TP-Link-defaults Script Python per provare password predefinite per alcuni hotspot TP-Link Ispirato da Utilizzo root@kitploit: usage: scan.py -h -p -t TIMEOUT Python script for trying default passwords for some TP-Link Hotspots optional arguments: -h, --help show this help message and exit -p,...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755

HCL Hive is affected by a missing rate limit that could allow an attacker to achieve unauthorized access via brute-force or credential stuffing attacks, or cause a denion of service . The CVSS 3.1 base score is 5.3 (MEDIUM) with a network attack vector, low complexity, and no privileges required....

EUVD-2026-64893

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

IkeAbuser

IkeAbuser Ein einfaches Tool-Wrapper zur Automatisierung der Enumeration, des Fingerprintings und der PSK-Extraktion eines IPSec-VPN-Gateways. Nichts Besonderes, nur ein Skript, das ich zusammengestellt habe, um bei CTFs und beim Lernen für die CPENT Zeit zu sparen. Es verknüpft ike-scan, nmap un...

reaver-wps-fork-t6x

Overview Reaver implements a brute force attack against Wifi Protected Setup WPS registrar PINs in order to recover WPA/WPA2 passphrases , as described in Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. by Stefan Viehböck. Reaver has been designed to be a robust an...

nelson

Nelson Encontrando vulnerabilidades através de força bruta burra Inspirado por uma palestra de Nicholas Carlini e pelo Ralph loop, Nelson é uma ferramenta para iterar sobre cada arquivo em um projeto, solicitando que um agente procure por vulnerabilidades. Ele possui um modo de varredura,...

RDWAtool

Uno strumento Python tutto-in-uno per estrarre informazioni, eseguire spray e brute force di password su un'applicazione Microsoft Remote Desktop Web Access RDWA. Questo strumento Python permette di estrarre varie informazioni da un'applicazione Microsoft Remote Desktop Web Access RDWA, come il...

CodeIgniterXor

CodeIgniterXor PoC-Skript zum Dekodieren von CodeIgniter = 2.1.4 Session-Cookies, die die xorencode-Methode verwenden. Vollständige Details finden Sie im folgenden Blogbeitrag: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Verwendung break.py Dies ist das Hauptskript. We...

xmlrpc-brute

Ferramenta de Força Bruta WordPress XML-RPC Uma ferramenta projetada para testar sites WordPress em busca de vulnerabilidades XML-RPC, tentando forçar credenciais de usuário através da interface XML-RPC. Descrição Esta ferramenta testa instalações WordPress em busca de vulnerabilidades de...

haklistgen

haklistgen Turns any junk text into a usable wordlist for brute-forcing. Installation root@kitploit: go install github.com/hakluke/haklistgen@latest Usage Examples Scrape all words out of an HTTP response to build a directory bruteforce wordlist: root@kitploit: curl https://wikipedia.org |...

API-SPY-API-PROBE

API-SPY 🕵️👻 Un potente strumento di brute-force sulle directory progettato per la ricognizione di API e il penetration testing. Scopre automaticamente endpoint API nascosti, esegue sottoscansioni ricorsive e sonda i metodi HTTP per un'enumerazione API più approfondita. Caratteristiche ✨...

BruteRatel-DetectionTools

BruteRatel-DetectionTools Eine Sammlung von Tools und Regeln zum Decodieren von Brute Ratel C4-Badgers Alle Tools und Regeln basieren auf Beispielen, die von PaloAlto in ihrem Bericht https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ identifiziert wurden. Yara-Regel Die Yara-Regel wurde...

passwordcheck

passwordcheck für rclone-Konfigurationsdateien In https://github.com/rclone/rclone/issues/4783 wurde ein Sicherheitsproblem gefunden, das dazu führte, dass von "rclone config" generierte Passwörter unsicher sein könnten. Dieses Programm überprüft Ihre rclone-Konfigurationsdatei auf solche...

lrs-pager-systems-bruteforce

lrs-pager-systems-bruteforce Long Range Pager Systems — ferramenta de informações e força bruta para pagers e coasters, usando URH e YS1 yardstick one / cc11xx lrs-pager-systems-bruteforce Long Range Pager Systems — ferramenta de informações e força bruta para pagers e coasters, usando URH e YS1...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2025-14602

vsDesk generates uploaded file names using a predictable timestamp-based method, allowing remote attackers to guess filenames and access uploaded files. Patched in version 14.0101; CVSS 4.0 scores it MEDIUM (5.3). No in-the-wild exploitation reported. Patch available from https://vsdesk.ru/. Advi...

EUVD-2025-210746

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...