brutespray

Brutespray 作成者: Shane Young/@x90sky && Jacob Robles/@shellfail 着想: Leon Johnson/@sho-luv 説明 Brutespray は、検出されたサービスに対して自動的にデフォルト認証情報を試行します。Nmap（GNMAP/XML）、Nessus、Nexpose、JSON、およびリストからのスキャン出力を受け取り、40以上のプロトコルに対して並列で認証情報のブルートフォースを実行します。Go で構築され、インタラクティブなターミナル UI、組み込みのワードリスト、再開機能を備えています。 クイックインストール...

CVE-2025-21574-Exploit

CVE-2025-21574-Exploit 此黑盒漏洞利用脚本的主要功能： 1. 凭据暴力破解： 测试 12 种以上常见的默认用户名/密码组合 检查 5 个常见的系统数据库 自动检测有效凭据 2. 匿名访问尝试： 尝试不使用任何凭据进行连接 如果启用了匿名访问，则测试所有数据库 3. 漏洞利用阶段： 使用 150,000+ 层嵌套以达到最大影响 自动检测服务器崩溃症状 测试所有有效的凭据/数据库组合 4. 错误处理： 区分连接错误与成功崩溃 优雅地处理各种 MySQL 错误情况 使用说明： 1. 将 TARGETIP 替换为目标服务器的 IP 地址 2. 安装先决条件：pip...

eCPPT-Penetration-Testing-Reports

eCPPT Penetration Testing Reports Penetration testing lab rep...

PT-2026-3668

Name of the Vulnerable Software and Affected Versions Milner ImageDirector Capture versions 7.0.9.0 through 7.6.3.25808 Description The software contains a flaw due to the use of a broken cryptographic algorithm DES. This impacts the Password class within the C2SConnections.dll component on Windo...

Exploit for Uncontrolled Resource Consumption in Oracle Mysql_Cluster

CVE-2025-21574-Exploit Key Features of this Black-Box Exploi...

Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery

Cybersecurity researchers have disclosed a surge in "mass scanning, credential brute-forcing, and exploitation attempts" originating from IP addresses associated with a Russian bulletproof hosting service provider named Proton66. The activity, detected since January 8, 2025, targeted organization...

Password Spray Attacks Taking Advantage of Lax MFA

In the first quarter of 2025, Rapid7’s Managed Threat Hunting team observed a significant volume of brute-force password attempts leveraging FastHTTP, a high-performance HTTP server and client library for Go, to automate unauthorized logins via HTTP requests. This rapid volume of credential...

SAP Management Console Brute Force

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Brute Force', 'Description' = %q This module simply attempts to brute force the username and password for the SAP Manageme...

CVE-2017-13719

The Amcrest IPM-721S AmcrestIPC-AWXXEngNV2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using HTTP APIs, instead of the web management interface that is provided by the application. This HTTP API receives the credentials as base64 encod...

TheMoon Rises Again, With a Botnet-as-a-Service Threat

TheMoon, an IoT botnet targeting home routers and modems, is entering a new phase, as it were: It has added a previously undocumented module that allows it to be sold as-a-service to other malicious actors. This has already had significant real-world consequences, according to CenturyLink Threat...