WifiPassword-Stealer

WifiPassword-Stealer Ottieni tutte le password Wi-Fi registrate dal computer di destinazione. INSTALLAZIONE se stai usando un file Python root@kitploit: pip install smtplib pip install subprocess pip install glob UTILIZZO •Crea un account su "https://mailtrap.io/" usando una mail temporanea...

metasploitable2-exploitation-metasploit

Sfruttare Metasploitable2 con Metasploit: VSFTPD, Samba e altro Una guida pratica allo sfruttamento utilizzando il Metasploit Framework — dalla configurazione del database PostgreSQL e la scansione dbnmap, attraverso tre shell root via vsftpd, Samba e UnrealIRCd, fino all'esfiltrazione delle...

FakeAuth

FakeAuth FakeAuth ist ein Tool, das nach Benutzeranmeldeinformationen fragt und diese über das HTTP-Protokoll exfiltriert. Inspiriert von folgenden Projekten 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Erwarten Sie schmutzigen Code und ein paar Fehler ; Installation Keine speziellen...

tirith

tirith आपका ब्राउज़र इसे पकड़ लेगा। आपका टर्मिनल नहीं पकड़ेगा। Website | Docs | SKILL.md | Changelog | Releases स्वतंत्र ओपन-सोर्स प्रोजेक्ट, जिसकी होस्टिंग Vercel Open Source Program Spring 2026 Cohort द्वारा समर्थित है। क्या आप अंतर देख सकते हैं? curl -sSL https://install.example-cli.dev | bash...

TeamFiltration

TeamFiltration TeamFiltration è un framework multipiattaforma per enumerare, spruzzare spray, esfiltrare e lasciare backdoor negli account O365 EntraID. Consulta la pagina wiki di TeamFiltration per un'introduzione su come funziona TeamFiltration e la Guida rapida per iniziare! Questo strumento è...

agent-vault

Proxy di credenziali HTTP e vault Un broker di credenziali open-source di Infisical che si pone tra i tuoi agenti e le API che chiamano. Gli agenti non dovrebbero possedere credenziali. Agent Vault elimina il rischio di esfiltrazione di credenziali grazie all'accesso intermediato. Nuovo qui? Ilpo...

CVE-2023-7231

CVE-2023-7231 – Catena SSRF critica → Memcached/Docker RCE tramite Audible fetchResource 🔥 Riepilogo Questa vulnerabilità abilita Server-Side Request Forgery SSRF nell'API fetchResource di Audible su .audible.com, consentendo a attaccanti non autenticati di spostarsi nell'infrastruttura interna...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- Il 13 febbraio 2024 Microsoft ha pubblicato una grave vulnerabilità di sicurezza in Microsoft Outlook, identificata come CVE-2024-21413, nota come Moniker Link Vulnerability. La vulnerabilità consente a un attaccante di bypassare il meccanismo...

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

PT-2026-80906

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-77081

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

EUVD-2026-63269

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are...

CVE-2026-77081

n8n's GraphQL node bypasses allowed-domains policy when Authentication is set to expression mode: with two different credential types attached, only the first credential's domain policy is enforced while both are transmitted, letting an authenticated workflow author exfiltrate a domain-restricted...