monsoon

monsoon 一个快速的HTTP枚举器，允许你执行大量的HTTP请求，过滤响应并实时显示 monsoon 是一个快速灵活的HTTP模糊测试工具，可用于从内容发现到凭证暴力破解等多种操作。你可以阅读我们的博客文章了解各种用例：“介绍monsoon - 一个精简而多功能的HTTP枚举器” 和 “将Monsoon提升到新高度”。 在以下示例中，针对filenames.txt中的每个条目发送一个HTTP GET请求，忽略所有状态码为404的响应： 安装 由于monsoon是一个静态链接的单一二进制文件，你可以简单地从发布页面下载适合你操作系统的预构建二进制文件。 从源码构建...

domainim

DOMAINIM Features • Usage • Installation • Usage • Contributing • Additional Notes Domainim is a fast domain reconnaissance tool for organizational network scanning. The tool aims to provide a brief overview of an organization's structure using techniques like OSINT, bruteforcing, DNS resolving...

altdns

Altdns - Subdomain discovery through alterations and permutations Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain such as test, dev, staging as well as takes in a list of...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

dnsbrute

dnsbrute Fuerza bruta DNS multihilo, velocidad media de 80 consultas/segundo con 40 hilos Uso: dnsbrute.py threads...

BruteConda

如果这对你有帮助，或许你可以通过赞助我来帮助我，这将有助于我创建更好的“开源工具” BruteConda 一款让你的工作更轻松的目录暴力破解工具！ 为什么选择 BruteConda？ 快速高效 易于使用 用户友好 要求： 需要安装 Python3 需要在 Python3 中安装以下模块：Requests、Time、Colorama、sys、argparse、os.path 使用方法： 1. git clone https://github.com/AkDevilHunter/BruteConda.git 2. cd BruteConda 3. python3 bruteconda.py...

kerbrute

Kerbrute A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication Grab the latest binaries from the releases page to get started. Background This tool grew out of some bash scripts I wrote a few years ago to perform bruteforcing using the...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

iPwn

iPwn 一个用于iOS设备漏洞利用的框架。 注意：使用此工具尝试进入的iPhone必须已越狱 状态 - ❌ 本项目仍在开发中。我正在添加更多用于后渗透利用的扩展和选项，以收集设备信息等。同时我也在研究如何将有效载荷放入正常的iOS插件中，从而使获取反向shell更加容易。 更新日志 6/2/21 - 为那些已将设备连接到电脑并希望进行调试的用户添加了一个额外菜单。将很快添加更多功能。 6/2/21 - 为'iSteal'后渗透工具添加了4个额外模块。还添加了安装checkra1n越狱的选项。 5/25/21 - 为'iSteal'后渗透工具添加了8个额外模块。 5/25/21 -...

ffufw

ffufw ffuf con esa salsa especial Instalación go install github.com/puzzlepeaches/ffufw@latest ¿Por qué? ffufw es un envoltorio de ffuf que hace que el ataque de fuerza bruta a directorios sea más fácil e inteligente. La herramienta tiene las siguientes características: Ejecución multihilo de...

HMAC_Bruteforcer

HMACBruteforcer Bruteforcer de claves HMAC muy lento Implementado en Bash Utiliza: OpenSSL Crunch Opcional...

EUVD-2022-42454

Malicious code in bioql PyPI...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login plugin (versions before 8.4.6.1 ) is vulnerable to an authentication bypass because it fails to implement rate limiting on OTP validation attempts. This flaw allows unauthenticated attackers to perform bruteforce attacks to guess SMS OTP values...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

U.S. Dept Of Defense: Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

The website had a directory that lacked authentication, allowing an attacker to add a new admin user and change the privileges of existing users without any authentication...

CVE-2023-49259 Bruteforcing authentication cookie for a given user

The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...

The Rising Diicot Threat Group with Diverse Attack Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Romanian threat group “Diicot” has been actively employing SSH bruteforcing and deploying malware loaders to compromise systems for the purpose of cryptocurrency mining. The campaign involves exploitin...

Improper Authentication

calibreweb is vulnerable to Improper Authentication. The vulnerability exists in the login function of web.py file, which allows a remote attacker to takeover the account by bruteforcing due to improper restriction of excessive authentication attempts...

TikTok: bypass two-factor authentication in Android apps and web

A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password...