recon-skills

🛡️ 侦察与渗透测试技能包 169项进攻性安全技能 ，用于侦察与渗透测试。来自600+公司目标 跨45+行业 的现场验证技术。更新了浏览器指纹规避、反机器人绕过、硬编码凭证搜寻、SCADA/ICS枚举。 📖 博客与研究 : hiago.sh — 渗透测试手册、实地笔记与工具。 📦 包含内容（169项技能） root@kitploit: recon-skills/ ├── SOUL.md — 哲学与代理操作指南 ├── AGENTS.md — 完整目录 + HARDLINE 技能标准 ├── recon/ 41 — WordPress/CORS/XMLRPC...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - i-doit Pro 25 及以下版本中的硬编码管理员凭据 i-doit Pro 25 及以下版本存在硬编码管理员凭据漏洞。该漏洞使任何人都可以使用用户名“admin”和密码“admin”登录为管理员。 产品描述：i-doit 是一款基于 Web 的开源 IT 文档和 CMDB（配置管理数据库）软件，由 synetics GmbH 开发。i-doit Pro 是该软件的商业版本，需要付费许可。它附带了额外功能、专业支持以及定期更新和增强功能。用户需要购买许可证才能使用 i-doit Pro，其费用根据用户数量和所需功能而有所不同。 漏洞描述：我们发现该...

CVE-2024-28987

CVE-2024-28987: SolarWinds Web Help Deskのハードコードされた認証情報の脆弱性 脆弱なサーバー上でCVE-2024-28987を悪用するための概念実証コードです。 ブログ記事 根本原因と侵害指標（IOC）はこちら： https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive 使用方法 root@kitploit: % python3 CVE-2024-28987....

CVE-2024-28987-POC

Descripción : El software SolarWinds Web Help Desk WHD está afectado por una vulnerabilidad de credenciales codificadas, que permite a un usuario remoto no autenticado acceder a funcionalidades internas y modificar datos. Impacto potencial : La explotación de CVE-2024-28987 podría permitir a un...

CVE-2024-28987

CVE-2024-28987 CVE-2024-28987 の実証コード：SolarWinds Web Help Desk ハードコードされた認証情報の脆弱性 概要 最新のチケットを最大25件抽出（APIの制限） 各チケットの詳細情報を取得 チケットIDを分析してシステム内の総チケット数を推定 構造化されたディレクトリ形式で出力を整理 理由 この脆弱性に対する他のエクスプロイトを基にしています。他のエクスプロイト（MSFconsoleなど）では出力が切り詰められてしまうため、すべてのチケットの全体を確認できるようにしました。 使用方法 root@kitploit: python3...

PT-2026-90525

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

EUVD-2026-75218

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-73519-WolfStack-PoC

CVE-2026-73519 — Secreto de clúster codificado en WolfStack → RCE no autenticado PoC de un secreto de autenticación predeterminado codificado en WolfStack que permite a un atacante remoto no autenticado ejecutar comandos arbitrarios como root dentro de cualquier contenedor Docker/LXC administrado...

POC-CVE-2022-26671

ここに辿り着いたのなら、このリポジトリが必要だった理由はご存知でしょう。 CVE-2022-26671 GET /AT/ATDefault.aspx 430行目に平文の認証情報が含まれています。 secom | supervisor 責任ある開示に関して言えば、ログインページでハードコードされた平文のHTTPボディレスポンスを開示しないのは馬鹿げています。/ https://nvd.nist.gov/vuln/detail/CVE-2022-26671...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

PT-2026-71705

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0 Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token JWT secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the...

CVE-2026-58245

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...

EUVD-2026-55875

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...

CVE-2025-13293

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

CVE-2026-12001

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through...

CVE-2025-59180

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

EUVD-2025-210515

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

CVE-2025-59180

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...