948 matches found
FakeAuth
FakeAuth FakeAuth is a tool that prompts for user credentials and exfiltrates it with HTTP protocol. Inspired by following projects 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Expect dirty code and some bugs ; Installation No special requirements Usage v1.01 root@kitploit: Usage: FakeAuth.e...
TeamFiltration
TeamFiltration TeamFiltration es un framework multiplataforma para enumerar, hacer spraying, exfiltrar y hacer backdoor a cuentas O365 EntraID. Visite la página wiki de TeamFiltration para una introducción sobre cómo funciona TeamFiltration y la Guía de inicio rápido para ponerse en marcha. Esta...
agent-vault
Proxy de credenciales HTTP y bóveda Un gestor de credenciales de código abierto de Infisical que se sitúa entre tus agentes y las API que llaman. Los agentes no deberían poseer credenciales. Agent Vault elimina el riesgo de exfiltración de credenciales con acceso intermediado. ¿Nuevo aquí?...
tirith
tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...
Malicious code in bt2-api-gateway-node-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...
WifiPassword-Stealer
WifiPassword-Stealer Obtén todas las contraseñas WiFi registradas de la computadora objetivo. INSTALACIÓN si estás usando un archivo python root@kitploit: pip install smtplib pip install subprocess pip install glob USO •Crea una cuenta en "https://mailtrap.io/" usando un correo temporal. •Estable...
THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-
THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- El 13 de febrero de 2024, Microsoft publicó una grave vulnerabilidad de seguridad en Microsoft Outlook, identificada como CVE-2024-21413 y conocida como Moniker Link Vulnerability. La vulnerabilidad permite a un atacante eludir el mecanismo...
metasploitable2-exploitation-metasploit
Explotando Metasploitable2 con Metasploit: VSFTPD, Samba y Más Un recorrido práctico de explotación con Metasploit Framework — desde la configuración de la base de datos PostgreSQL y el escaneo con dbnmap, pasando por tres shells de root vía vsftpd, Samba y UnrealIRCd, hasta la exfiltración de...
CVE-2023-7231
CVE-2023-7231 – Cadena crítica de SSRF → Memcached/Docker RCE a través de fetchResource de Audible 🔥 Resumen Esta vulnerabilidad permite Server-Side Request Forgery SSRF en la API fetchResource de Audible en .audible.com, permitiendo a atacantes no autenticados pivotar hacia la infraestructura...
CVE-2026-71366
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
CVE-2026-71366
A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...
EUVD-2026-64923
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
CVE-2026-71366
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
PT-2026-80906
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
CVE-2026-73137
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...
CVE-2026-77081
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...
EUVD-2026-63269
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...
CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...
CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...
CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...