iPwn

iPwn Um Framework voltado para a exploração de dispositivos iOS. LEMBRE-SE: O IPHONE QUE VOCÊ ESTÁ TENTANDO ACESSAR COM ESTA FERRAMENTA DEVE ESTAR COM JAILBREAK Status - ❌ Este projeto ainda está em desenvolvimento. Estou adicionando mais extensões e opções para pós-exploração para coletar...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

dnsbrute

dnsbrute मल्टी-थ्रेडेड DNS ब्रूटफोर्सिंग, 40 थ्रेड्स के साथ औसत गति 80 लुकअप/सेकंड root@kitploit: Usage: dnsbrute.py threads...

HMAC_Bruteforcer

HMACBruteforcer Bruteforceur de clé HMAC très lent Implémenté en Bash Utilise : OpenSSL Crunch Optionnel...

BruteConda

Se isto te ajudou, talvez possas ajudar-me patrocinando-me, o que me ajudará a criar melhores 'ferramentas open-source' BruteConda Uma ferramenta de força bruta de diretórios que torna a tua vida mais fácil! Por que apenas BruteConda? Rápido e Eficiente Fácil de Usar Amigável para o utilizador...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

monsoon

monsoon Ein schneller HTTP-Enumerator, mit dem Sie eine große Anzahl von HTTP-Anfragen ausführen, die Antworten filtern und in Echtzeit anzeigen können monsoon ist ein schneller und flexibler HTTP-Fuzzer, der für eine Vielzahl von Aufgaben eingesetzt werden kann, von der Inhaltserkennung bis zum...

domainim

DOMAINIM Features • Usage • Installation • Usage • Contributing • Additional Notes Domainim is a fast domain reconnaissance tool for organizational network scanning. The tool aims to provide a brief overview of an organization's structure using techniques like OSINT, bruteforcing, DNS resolving...

altdns

Altdns - Subdomain discovery through alterations and permutations Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain such as test, dev, staging as well as takes in a list of...

kerbrute

Kerbrute A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication Grab the latest binaries from the releases page to get started. Background This tool grew out of some bash scripts I wrote a few years ago to perform bruteforcing using the...

ffufw

ffufw ffuf com aquele molho especial Instalação root@kitploit: go install github.com/puzzlepeaches/ffufw@latest Por quê? O ffufw é um wrapper em torno do ffuf para tornar o bruteforce de diretórios mais fácil e inteligente. A ferramenta possui os seguintes recursos: Execução multithread de comand...

EUVD-2022-42454

Malicious code in bioql PyPI...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

CVE-2025-4094 affects the Digits WordPress plugin: versions prior to 8.4.6.1 do not rate-limit OTP validation attempts, enabling brute-force attacks that can bypass authentication. Public disclosures and PoCs describe OTP brute-forcing across forgot-password and OTP validation endpoints, with exp...

U.S. Dept Of Defense: Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

The website had a directory that lacked authentication, allowing an attacker to add a new admin user and change the privileges of existing users without any authentication...

CVE-2023-49259 Bruteforcing authentication cookie for a given user

The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...

The Rising Diicot Threat Group with Diverse Attack Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Romanian threat group “Diicot” has been actively employing SSH bruteforcing and deploying malware loaders to compromise systems for the purpose of cryptocurrency mining. The campaign involves exploitin...

Improper Authentication

calibreweb is vulnerable to Improper Authentication. The vulnerability exists in the login function of web.py file, which allows a remote attacker to takeover the account by bruteforcing due to improper restriction of excessive authentication attempts...

TikTok: bypass two-factor authentication in Android apps and web

A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password...