38 matches found
Klyda
Klyda 프로젝트는 온라인 웹 애플리케이션에 대한 빠른 자격 증명 기반 공격을 돕기 위해 만들어졌습니다. Klyda는 간단한 비밀번호 스프레이부터 대규모 멀티스레드 사전 공격까지 지원합니다. Klyda는 새로운 프로젝트이며, 기여를 찾고 있습니다. 어떤 도움이라도 매우 감사합니다. Klyda는 간단하고 기억하기 쉬운 사용법을 제공하지만, 필요에 따라 구성도 가능합니다: 멀티스레드 작업 단어 목록을 결합하여 더 큰 규모의 공격 데이터 블랙리스트로 결과 좁히기 은밀한 목적을 위해 스레드 속도 제한 설치 및 사용법 1 Git 저장...
Kraken
무차별 대입 공격을 중앙화하고 간소화하는 Python 기반 도구 프로젝트 소개 Kraken 은 다양한 무차별 대입 작업을 중앙화하고 간소화하도록 설계된 강력한 Python 기반 도구입니다. Kraken은 사이버 보안 전문가가 다양한 프로토콜과 서비스에서 효율적으로 무차별 대입 공격을 수행할 수 있는 도구 모음을 제공합니다. ⚠️ 경고: 법적 고지 이 도구는 교육 목적으로만 제작되었습니다. 저자는 이 도구의 불법적인 사용에 대해 책임을 지지 않습니다. 사용자는 자신의 행동에 대해 전적인 책임을 집니다. 👀 스크린샷 ⚙️ 설치...
credential-attacks-toolkit
CredAttack — 자격 증명 공격 툴킷 ⚠️ 법적 고지 — 승인된 보안 테스트 전용. 본 도구를 소유하지 않았거나 명시적인 서면 허가 를 받지 않은 시스템에 사용하는 것은 미국의 Computer Fraud and Abuse Act, 영국의 Computer Misuse Act 및 전 세계의 동등한 법률에 따라 불법입니다. SECURITY.md를 참조하세요. 목차 CredAttack이란 무엇인가? 공격 모드 지원 프로토콜 아키텍처 빠른 시작 설치 CLI 참조 비밀번호 변형 엔진 기본 자격 증명 데이터베이스 프록시 순환 HTML...
CVE-2026-77582: Observable Timing Discrepancy
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...
credential-attacks-toolkit — Updated!
CredAttack — Credential Attacks Toolkit ⚠️ LEGAL NOTICE — Authorised security testing ONLY. Using this tool against systems you do not own or have explicit written permission to test is illegal under the Computer Fraud and Abuse Act US, Computer Misuse Act UK, and equivalent laws worldwide. See...
CVE-2026-76940 Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer P2P relay technique. The activity, codenamed Operatio...
CVE-2026-54739: Observable Response Discrepancy
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound respons...
CVE-2026-56577
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...
CVE-2026-56577 HCL MyCloud affected by Weak Password Policy
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...
PT-2026-62003
Name of the Vulnerable Software and Affected Versions HCL MyCloud affected versions not specified Description The software implements a weak password policy, which increases the risk of account compromise via credential-based attacks or brute-force attempts, where an attacker systematically tries...
vantage6 vulnerable to username timing attack
ImpactIt is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks WorkaroundsNo...
PYSEC-2026-2008 vantage6 vulnerable to username timing attack
Impact It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks Workarounds No...
Containing a domain compromise: How predictive shielding shut down lateral movement
In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...
CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerat...
CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerat...
VulnForge
VulnForge AI-Powered Vulnerability Scanner & Auto-Exploit E...
CVE-2025-25236
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks...
