Bluto

BLUTO DNS Recon | Brute Forcer | DNS Zone Transfer | DNS Wild Card Checks | DNS Wild Card Brute Forcer | Email Enumeration | Staff Enumeration | Compromised Account Enumeration | MetaData Harvesting Author: Darryl Lane | Twitter: @darryllane101 https://github.com/darryllane/Bluto Like Bluto? Give...

email-osint-ripper

email-osint-ripper EO-RIPPER.PY is a perfect tool for doing OSINT on an email or a list of emails. Its functionalities are diverse and allow us to obtain a lot of information about our target. Videos https://www.youtube.com/watch?v=Eo9mJLBc2c&t=254s...

UhOh365

UhOh365 A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerabilit...

reconspider

El Marco de Inteligencia de Fuentes Abiertas OSINT Más Avanzado ReconSpider ReconSpider es el marco de Inteligencia de Fuentes Abiertas OSINT más avanzado para escanear direcciones IP, correos electrónicos, sitios web, organizaciones y obtener información de diferentes fuentes. ReconSpider puede...

disclo

disclo Domain contact finder. Give it a domain, get every email, handle, and lead associated with it - across 12 passive sources, in parallel. $ python disclo.py gitlab.com disclo - gitlab.com ---------------------------------------------------------------------- hackerone...

HunterScrape

This is a python script using the hunter.io API to pull data on a target domain, then generate a target email list. This is primarily for password spraying using a tool like Go365 or TREVORspray. Usage: HunterScrape-Dev.py -h -d DOMAIN -k KEY -l LIMIT -f -o OUTFILE options: -h, --help show this...

holehe

Holehe OSINT - Correos Electrónicos a Cuentas Registradas 👋 ¡Hola! Para cualquier consulta profesional o colaboración, contáctame en: [email protected] 📧 Preferiblemente, usa tu correo profesional para la correspondencia. ¡Seamos breves y concisos, y todo en inglés! Versión Online de Holehe...

osi.ig

Open Source Information Instagram Últimamente, Instagram empezó a enviar respuestas HTML en lugar de JSON a las solicitudes "desconocidas". Realmente quería que esto funcionara sin inicio de sesión, ya que ya no uso Instagram. Intenté algunas formas que conocía para hacerlo funcionar sin iniciar...

Bluto-Old

BLUTO Bluto has moved to a new repo, this version is now deprecated. New version and repo can be found https://github.com/darryllane/Bluto Latest Version Features: DNS recon SubDomain Brute forcer DNZ Zone Transfers DNS Wild Card Checks DNS Wild Card Brute Forcing Email Enumeration Staff...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Automated Exploit - Usage Guide What This Script Does Automates the full account takeover chain in 4 HTTP request groups: 1. Vulnerability Verification - Confirms the target is vulnerable 2. Email Enumeration - Extracts admin email via boolean oracle 500 requests 3. Password Reset...

pepe

PEPE - Correos Electrónicos de Pastebin para Post-Explotación Recopila información sobre direcciones de correo electrónico filtradas de Pastebin Acerca de El script analiza los volcados de email:contraseña de Pastebin y recopila información sobre cada dirección de correo electrónico. Soporta...

SocialPwned

SocialPwned SocialPwned is an OSINT tool that allows to get the emails, from a target, published in social networks like Instagram, Linkedin and Twitter to find the possible credential leaks in PwnDB or Dehashed and obtain Google account information via GHunt. The purpose of this tool is to...

Gitmails

Desarrollo - IMPORTANTE Esta versión de Gitmails ya no recibe mantenimiento. Echa un vistazo a la versión de Gitmails Shell si deseas usar una versión que recibe mantenimiento y, con suerte, se desarrolla. Si no deseas usar la versión de shell y prefieres la versión en Python, siéntete libre de...

CVE-2026-XXXX-atlassian-email-enumeration

CVE-2026-XXXX: Atlassian Central GraphQL — Email Enumeration Oracle Product Atlassian Central GraphQL Gateway api.atlassian.com/graphql Vulnerability Type CWE-204: Observable Response Discrepancy — Email Enumeration Oracle Severity MEDIUM — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Description...

zte-smartlife-app-pwned

ZTE SmartLife Security Findings Leading to Account Takeover T...

CVE-2026-86554 Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email...

CVE-2026-86554 Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email...

CVE-2026-86554

ZTE SmartLife APP is affected by an email enumeration and account ID leakage vulnerability. The app dynamically generates authentication parameters in its runtime process, which an attacker with low privileges can extract and use to invoke the backend endpoint /account/verify.serv . This allows a...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django versions 5.1.1, 5.0.9, and 4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view that implements password reset processes, allows remote attackers to enumerate user email addresses by sending password reset requests and observing the...

CVE-2026-90537 WWBN AVideo Scheduler sendEmail Missing Authorization via Token

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...