credential-attacks-toolkit

CredAttack — Toolkit per Attacchi alle Credenziali ⚠️ AVVISO LEGALE — Solo test di sicurezza autorizzati. L'uso di questo strumento contro sistemi che non possiedi o per i quali non hai esplicita autorizzazione scritta è illegale ai sensi del Computer Fraud and Abuse Act USA, del Computer Misuse...

CVE-2026-54356

CVE-2026-54356 — Budibase: emissione autenticata di URL di upload firmati S3 arbitrari Un utente autenticato con privilegi bassi ruolo BASIC di un workspace Budibase pubblicato può chiamare POST /api/attachments/:datasourceId/url e ottenere un URL di upload pre-firmato S3 firmato con le credenzia...

SSH-Stealer

RunAs-Stealer Capacità di keylogging intelligente per rubare le credenziali SSH, inclusi password e chiave privata Uso Le credenziali rubate vengono scritte nello stream ADS log di C:\Users\Desktop\desktop.ini. Per ottenere le credenziali, digitare il comando cmd: root@kitploit: more...

CheckPWD

Contesto del progetto Durante i test di penetrazione capita spesso di imbattersi in vari software applicativi e dispositivi di rete, soprattutto all'interno della rete interna. Quando si incontrano obiettivi di questo tipo, la prima reazione è tentare l'accesso con le password predefinite. Sulla...

static-file-checker

static-file-checker Verifica la presenza di credenziali esposte in /static/staticfiles.json di Django tramite nuclei...

jeopardize

Introduction Jeopardize tool is developed to provide basic threat intelligence&response capabilities against phishing domains at the minimum cost as possible. It detects registered phishing domain candidates typosquatting, homograph etc., analyzes them and assigns a risk score to them. After then...

gitrob

Gitrob: Putting the Open Source in OSINT Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github. Gitrob will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that...

gladius

Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

whispers

Whispers „Meine kleinen Vögel sind überall, sogar im Norden, sie flüstern mir die seltsamsten Geschichten zu.“ - Lord Varys Whispers ist ein statisches Code-Analyse-Tool, das verschiedene gängige Datenformate parst, um hartcodierte Anmeldeinformationen und gefährliche Funktionen zu finden. Whispe...

dmi-tcat

DMI TCAT Il Twitter Capture and Analysis Toolset DMI-TCAT della Digital Methods Initiative consente di recuperare e raccogliere tweet da Twitter e analizzarli in vari modi. Installazione Puoi trovare istruzioni dettagliate per l'installazione nel wiki Requisiti Credenziali API di Twitter possono...

CVE-2026-76155

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-76131

Hard-coded credentials in VOCALOID6 Editor allow network-based impersonation of the legitimate client, enabling unauthorized access to Yamaha's activation and content servers. CVSS 3.1 scores this MEDIUM (5.3). No exploit code or in-the-wild exploitation is documented; monitor Yamaha and JPCERT a...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

EUVD-2026-63798

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

CVE-2026-76155

Datiphy Data Management Center versions v8.3.0 through v8.5.1 ship with default administrator credentials, enabling unauthenticated remote attackers to gain full administrative access. CVSS 9.3 CRITICAL; no patch or exploitation evidence provided in documents. Upgrade to a patched version or chan...

EUVD-2026-63795

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

PT-2026-79388

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

CVE-2026-50192

Kerberos Agent (open-source video surveillance agent) prior to v3.6.26 leaks the Hub private key (X-Kerberos-Hub-PrivateKey) to a cross-host redirect target. The UploadKerberosHub function in machinery/src/cloud/kerberos_hub.go uses a bare &http.Client{} without a CheckRedirect policy. Go's net/h...