Wordpress XML-RPC System.multicall Credential Collector

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require 'metasploit/framework/loginscanner/wordpressmulticall' class MetasploitModule 'Wordpress XML-RPC...

Advantech WebAccess 8.1 Post Authentication Credential Collector

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Advantech WebAccess 8.1 Post Authentication Credential Collector", 'Description' = %q This module allows you to log into Advantech WebAccess 8.1,...

Jenkins Credential Collector

This module can be used to extract saved Jenkins credentials, user tokens, SSH keys, and secrets. Interesting files will be stored in loot along with combined csv output. require 'nokogiri' require 'base64' require 'digest' require 'openssl' require 'sshkey' class MetasploitModule 'Jenkins...

Advantech WebAccess 8.1 Post Authentication Credential Collector Exploit

Usage Info msf use auxiliary/gather/advantechwebaccesscreds msf auxiliaryadvantechwebaccesscreds show actions ...actions... msf auxiliaryadvantechwebaccesscreds set ACTION msf auxiliaryadvantechwebaccesscreds show options ...show and set options... msf auxiliaryadvantechwebaccesscreds run This...

Advantech WebAccess 8.1 Post Authentication Credential Collector

This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials. Although authentication is required, any level of user permission can exploit this vulnerability. Note that 8.2 is not suitable for this. This module requires Metasploit: https://metasploit.com/downloa...

Wordpress XML-RPC system.multicall Credential Collector

This module attempts to find Wordpress credentials by abusing the XMLRPC APIs. Wordpress versions prior to 4.4.1 are suitable for this type of technique. For newer versions, the script will drop the CHUNKSIZE to 1 automatically. This module requires Metasploit: https://metasploit.com/download...

Windows Single Sign On Credential Collector (Mimikatz)

This module will collect cleartext Single Sign On credentials from the Local Security Authority using the Kiwi Mimikatz extension. Blank passwords will not be stored in the database. This module requires Metasploit: https://metasploit.com/download Current source:...

HTTP Client Basic Authentication Credential Collector

This module responds to all requests for resources with a HTTP 401. This should cause most browsers to prompt for a credential. If the user enters Basic Auth creds they are sent to the console. This may be helpful in some phishing expeditions where it is possible to embed a resource into a page...

Windows Gather Credential Collector

This module harvests credentials found on the host and stores them in the database. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Credential Collector', 'Description' = %q This...