Legion - An Easy-To-Use, Super-Extensible And Semi-Automated Network Penetration Testing Tool That Aids In Discovery, Reconnaissance And Exploitation Of Information Systems

Legion, a fork of SECFORCE's Sparta, is an open source, easy-to-use, super-extensible and semi-automated network penetration testing framework that aids in discovery, reconnaissance and exploitation of information systems. Legion is developed and maintained by GoVanguard. More information about...

Cross-site Scripting (XSS)

github.com/ory/hydra is vulnerable to cross-site scripting XSS. The vulnerability exists because it does not escape the errorhint parameter in the default error handler, allowing the attacker to inject arbitrary script through it...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

Cross site scripting

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 is affected by a Reflected XSS vulnerability in the oauth2/fallbacks/error error_hint parameter. The issue allows injection of arbitrary script via that parameter. No exploitation status or mitigations are provided in the excerpt; refer to the CVE entry and li...

PT-2019-19013

Name of the Vulnerable Software and Affected Versions ORY Hydra versions prior to v1.0.0-rc.3+oryOS.9 Description The issue concerns a Reflected XSS that can be triggered via the oauth2/fallbacks/error endpoint, specifically through the error hint parameter. Recommendations For versions prior to...

Zomato: [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider

Heyy there, I have found a xss in auth2.zomato.com Full url:https://auth2.zomato.com/oauth2/fallbacks/error?error=xss&errordescription=xss&errorhint=xss Vulnerable Parameters: All available parameters are vulnerable XSS Payload: XSS Steps To Reproduce the xss Just copy paste and load this url in...

Session Fixation

github.com/ory/hydra is vulnerable to session fixation attacks. A malicious user can pass a consent uri missing a CSRF token to the user and log in afterwards as that user through a callback url...

CERIO DT-100G-N/DT-300N/CW-300N - Multiple Vulnerabilities

CERIO 11nbg 2.4Ghz High Power Wireless Router pekcmd Rootshell Backdoors Vendor: CERIO Corporation Product web page: http://www.cerio.com.tw Affected version: DT-100G-N fw: Cen-WR-G2H5 v1.0.6 DT-300N fw: Cen-CPE-N2H10A v1.0.14 DT-300N fw: Cen-CPE-N2H10A v1.1.6 CW-300N fw: Cen-CPE-N2H10A v1.0.22...

Very Fast Network Logon Cracker: THC-Hydra

Very Fast Network Logon Cracker Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules are easy to add, beside that, it is flexible and very fast. This fast, and...

SPARTA - Network Infrastructure Penetration Testing Tool

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

THC-Hydra 8.2 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

Automatically Brute Force All Services – BruteX

Automatically brute force all services Including: Open ports DNS domains Web files Web directories Usernames Passwords Dependencies: NMap Hydra Wfuzz SNMPWalk DNSDict Download: git clone https://github.com/1N3/BruteX.git Usage: ./brutex target To brute force multiple hosts, use brutex-massscan an...

BruteX - Automatically Brute Force all Services Running on a Target

Automatically brute force all services running on a target including: Open ports DNS domains Web files Web directories Usernames Passwords USAGE ./brutex target DEPENDENCIES NMap Hydra Wfuzz SNMPWalk DNSDict To brute force multiple hosts, use brutex-massscan and include the IP's/hostnames to scan...

SPARTA - Network Infrastructure Penetration Testing Tool

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

HP-VSA-Remote-Execution

HP VSA / SANiQ Hydra client Nicolas Grégoire [email protected] v0.5 HOST = '192.168.201.11' The remote host PORT = 13838 The hydra port import getopt import re import sys import binascii import struct import socket import os ''' ================================== Define functions...

PwnPi - A Pen Test Drop Box distro for the Raspberry Pi

PwnPi is a Linux-based penetration testing dropbox distribution for the Raspberry Pi. It currently has 200+ network security tools pre-installed to aid the penetration tester. It is built a stripped down version of the Debian Wheezy image from the Raspberry Pi foundation's website and uses Openbo...

Smart Pentester - An SSH based Penetration Testing Framework

Smart Pentester is an SSH based Penetration Testing Framework. It provides a GUI for well known tools like nmap, hping, tcpdump, volatility, hydra and etc. Smart Pentester Framework will provide you a User Interface for Penetration testing, Malware Analysis, Forensic Analysis, Cyber Intelligence,...