assless-chaps

assless-chaps Crack MSCHAPv2/NTLMv1 challenge/responses quickly using a database of NT hashes Introduction Assless CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response e.g. from a WiFi EAP WPE attack. It requires a database of ...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

terrier

Terrier Terrier is a Image and Container analysis tool that can be used to scan OCI images and Containers to identify and verify the presence of specific files according to their hashes. A detailed writeup of Terrier can be found on the Heroku blog,...

keimpx

Introduction keimpx is an open source tool, released under the Apache License 2.0. It can be used to quickly check for valid credentials across a network over SMB. Credentials can be: Combination of user / plain-text password. Combination of user / NTLM hash. Combination of user / NTLM logon...

lil-pwny

Lil Pwny Python を使用した Active Directory パスワードの高速オフライン監査。 Lil Pwny について Lil Pwny は、Active Directory から取得したユーザーパスワードの NTLM ハッシュを、Have I Been Pwned から既知の侵害済みパスワードとオフラインで照合する Python アプリケーションです。結果は JSON 形式で出力され、ユーザー名、一致したハッシュ（難読化可能）、HIBP でそのパスワードが確認された回数が含まれます。 Lil Pwny の詳細は私のブログをご覧ください。 機能 カスタムパスワード監査...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

penglab

Penglab Abuse of Google Colab for fun and profit. 🐧 What is it ? Penglab is a ready-to-install setup on Google Colab for cracking hashes with an incredible power, really useful for CTFs. See benchmarks below. It installs by default : Hashcat John Hydra SSH with ngrok And now, it can also : Launch...

subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

ranger

ranger セキュリティ専門家がリモートのMicrosoft Windowsベースのシステムにアクセスし、操作するためのツール。 このプロジェクトは、私たちは弓や矢を発明したわけではなく、単により効率的な使用方法を考案したという考え方に基づいています。 Rangerはコマンドライン駆動の攻撃・ペネトレーションテストツールであり、インスタンス化されたカタパルトサーバーを使用してWindowsシステムに対して機能を提供する能力を持っています。ユーザーが資格情報またはハッシュセット（NTLM、LM、LM:NTLM）を持っている限り、信頼関係にあるシステムにアクセスできます。...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and...

CVE-2021-44228-Log4Shell-Hashes

CVE-2021-44228-Log4Shell-哈希值 受影响的LOG4J版本的哈希值 创建目的：帮助组织搜索这些受影响版本 https://www.lunasec.io/docs/blog/log4j-zero-day/ 哈希值来源：https://archive.apache.org/dist/logging/log4j/ 可能1.X版本受影响，详见https://github.com/apache/logging-log4j2/pull/608 版本1.0并不受此漏洞影响：https://twitter.com/ceki/status/1469449618316533762?s=...

CVE-2026-8863

CVE-2026-8863 CVE-2026-8863 の影響を受ける署名済み UEFI Secure Boot shim バイナリのコレクションです。各イメージに埋め込まれた shim バージョン、Authenticode 署名者、失効ハッシュを収録しています。 バイト単位で同一の署名済み shim を同梱するリリースは 1 行に集約されます — 1 つの Authenticode ハッシュは、それを含むリリースの数に関係なく、1 つの dbx エントリです。 詳細は 私のブログ をご覧ください。 概要...

CVE-2025-32044

CVE-2025-32044 — Moodle の認証なし REST API ユーザーデータ漏えい スタックトレース引数の漏えい → 氏名、メールアドレス、パスワードハッシュ 概要 CVE-2025-32044 は、Moodle LMS 4.5.0 から 4.5.2 に存在する、認証なし で悪用可能な高深刻度（CVSS 7.5）の情報漏えい脆弱性です。 この脆弱性は、Moodle の REST API 例外ハンドラ、つまり lib/classes/router/response/exceptionresponse.php 内の...

CVE-2024-24919

チェックポイント: CVE-2024-24919 CVEを実行 root@kitploit: nuclei -list chick.txt -t CVE-2024-24919.yaml をターゲットIPアドレスに置き換えると、このコマンドは/etc/shadowファイル（パスワードハッシュを含む）へのアクセスを試みます。 root@kitploit: curl --path-as-is -i -s -k -X POST \ -H 'Host: 117.102.198.7 ' \ -H 'Content-Length: 39' \ -H 'Connection: keep-alive' ...

EUVD-2026-68202

Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync Riferimento: https://adsecurity.org/?p=1729 Riferimento: https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ Obiettivo: recuperare gli hash delle password di tutti gli account utente su un controller di dominio utilizzando la funzione DCSync di...

ioccheck

ioccheck A tool for simplifying the process of researching file hashes, IP addresses, and other indicators of compromise IOCs. Features Look up hashes across multiple threat intelligence services, from a single command or a few lines of Python. Currenty supports the following services: VirusTotal...

CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...