668 matches found
ninjasworkout
Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...
adfsbrute
adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...
bluemonday
bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...
rmiscout
Description RMIScout enables wordlist and bruteforce attacks against exposed Java RMI interfaces to safely guess method signatures without invocation. It supports multiple Java RMI protocols, method invocation, and exploitation. Feature overview Supports multiple types of Java RMI servers: RMI-JR...
wifi-bruteforcer-fsecurify
WiFi Bruteforcer - Fsecurify WARNING: This project is still under development and by installing the app may desconfigure the Wi-Fi settings of your Android OS, a system restore may be necessary to fix it. Android application to brute force WiFi passwords without requiring a rooted device...
GadgetProbe
Description You just found a Java deserialization bug, you ran all your ysoserial payloads, and.... you got nothing. What now? How can you debug or build a gadget chain if you're totally blind? Introducing GadgetProbe, a tool that shines a light on remote classpaths and raises bug severity for al...
SocialBox
SocialBox SocialBox is a Bruteforce Attack Framework Facebook , Gmail , Instagram ,Twitter , Coded By Belahsan Ouerghi Installation sudo apt-get install git git clone https://github.com/TunisianEagles/SocialBox.git cd SocialBox chmod +x SocialBox.sh chmod +x install-sb.sh ./install-sb.sh...
bkcrack
bkcrack Crack legacy zip encryption with Biham and Kocher's known plaintext attack. Overview A ZIP archive may contain many entries whose content can be compressed and/or encrypted. In particular, entries can be encrypted with a password-based symmetric encryption algorithm referred to as...
Dagon
Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...
HostileSubBruteforcer
HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...
service-now
service-now Service-Now Article Bruteforcer The idea here is that there is misconfiguration with articles and could expose sensitive information. Any Issues raise the it here - https://github.com/RandomRobbieBF/service-now/issues or submit a PR! How to Use python3 service-now.py -u...
knockpy
🔍 Knockpy Subdomain Scan v9.0 ✅ Fast & Async • 🔐 Recon + Brute • 🔧 Easy to Extend KnockPy is a modular Python 3 tool to enumerate subdomains via passive reconnaissance and bruteforce, now with async/await support , enhanced performance, and modern HTTP/TLS handling. 🚀 Features v9 ✅ Async scanning...
wpscan
WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...
shuffledns
massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support Feature • Install • Run • Wildcard • License • Discord shuffleDNS is a wrapper around massdns, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomain...
punk.py
punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...
CVE-2022-46169-CACTI-1.2.22
CVE-2022-46169-CACTI-1.2.22 This is a exploit of CVE-2022-46169 to cacti 1.2.22. This exploit allows through an RCE to obtain a reverse shell on your computer. Requirement optparse requests Usage On a port on your machine listen and then run the exploit as follows. python3 CVE-2022-46169.py -u...
domi-owned
Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...
pown
Pown Pown.js is a security testing and exploitation toolkit built on top of Node.js and NPM. Unlike traditional security tools, notably Metasploits, Pown.js considers frameworks to be an anti-pattern. Therefore, each feature in Pown is in fact a standalone NPM module allowing greater degree of...
geo-recon
Geo-Recon An OSINT CLI tool desgined to fast track IP Reputation and Geo-locaton look up for Security Analysts. Pre-requirements for Linux Python3 bash sudo apt install python3 Pip3 bash sudo apt install python3-pip If you don't use Debian or Ubuntu, search for their respective platforms like yum...