legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

hydra

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and conse...

Athanasius

Athanasius Hacking Framework Installation 1.Clone Repo git clone https://github.com/shyam999/Athanasius.git 2.Install Requirements pip install -r requirements.txt 3.Install hydra sudo apt install hydra 4.Run The Script python athanasius.py Screenshot Where to find Me Like Me on Facebook Or visit ...

mass-bruter

Mass Bruter Mass bruteforce network protocols Info Simple POC to quickly mass bruteforce common services in a large scale of network. It will check for default credentials on ftp, ssh, mysql, mssql...etc. This was made for authorized penetration testing purpose only. How it works 1. Use...

penglab

Penglab Abuse of Google Colab for fun and profit. 🐧 What is it ? Penglab is a ready-to-install setup on Google Colab for cracking hashes with an incredible power, really useful for CTFs. See benchmarks below. It installs by default : Hashcat John Hydra SSH with ngrok And now, it can also : Launch...

HydraDragonAntivirus

Hydra Dragon Antivirus WARNING: Highly outdated documenation here but for reference I keep it. Other than OpenEDR, MBRFilter, Sanctum etc. directories are fully deperecated for performance. 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. 🎥 POC:...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra Deliver malware via CVE-2024-21412 usage Start the services in order, then access the web server. webserver Start a web server in the folder: python -m http.server Initial Access: Use Windows Advanced Query Syntax AQS to link back to a JPEG trojan hosted on a WebDAV shar...

ubuntu-privesc-lab

ubuntu-privesc-lab Full penetration testing workflow: credential brute force, SSH access and privilege escalation CVE-2021-4034 OVERVIEW This project demonstrates a full penetration testing workflow against a vulnerable Ubuntu virtual machine. The attack chain includes reconnaissance, credential...

CVE-2025-68055-poc

CVE-2025-68055 Authenticated SQL injection in Hydra Booking Plugin get function, Hydra Booking hardcodes user input directly into the raw sql request instead of using prepare to sanitize input, leading to Time-Based Blind SQL injection. Exploit A simple run command as such will tell you whether o...

t14m4t

t14m4t t14m4t is an automated brute-forcing attack tool, wrapper of THC-Hydra and Nmap Security Scanner. t14m4t is scanning an user defined target or a document containing targets for open ports of services supported by t14m4t , and then starting brute-forcing attack against the services running ...

MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal

MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 = Maintenance Pack 36 with Servicepack 8 week 36/2025 contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows ...

xmlrpc-bruteforcer

An XMLRPC BruteForcer for Wordpress - Inpired by 1N3@CrowdShield Note - This project is discontinued Usage python3 xmlrcpbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt username python3 xmlrpcbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt userlist.txt in progess Target is...

Mirai-Spray

Mirai-Spray Scans typical Mirai loader/hostlists format with Hydra. This can be used to check if a list of hosts are able to be connected to. INSTALLATION apt update -y && apt upgrade -y apt install tor git clone https://github.com/Skotizo/Mirai-Spray cd Mirai-spray g++ main.cpp -o spray ./spray...

CVE-2026-62162

A flaw was found in Hydra. A remote attacker can intercept and steal committed funds by observing pending deposit transactions on the network. Because the deposit verification logic fails to properly constrain transaction outputs or verify protocol state, an attacker can submit a transaction...

CVE-2026-62162

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

EUVD-2026-114282

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

CVE-2026-62162 Hydra: Deposit Claim omits Head state-token spending requirement

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

CVE-2026-62162

The Hydra layer-two scalability solution for Cardano is vulnerable in versions prior to 2.1.0 due to a missing invariant in the Claim branch of hydra-plutus/validators/deposit.ak. The validator fails to require spending the Head state-token UTxO within the same transaction and lacks output constr...

CVE-2026-62162 Hydra: Deposit Claim omits Head state-token spending requirement

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...

CVE-2026-62162: cardano-scaling hydra: Hydra is a layer-two scalability solution for Cardano

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the Claim branch in hydra-plutus/validators/deposit.ak checks only that datum.headid matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires...