CVE-2022-31007-Python-POC

Python automation of the following write up on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0. Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electron...

web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install root@kitploit: python3 -m pip install -r requirements.txt ⏩ Usage root@kitploit: $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / |...

DonPwner

🔥 DonPwner - Advanced DonPAPI Analysis & Attack Tool Advanced Password Spray & Credential Analysis Tool - Leveraging DonPAPI with Smart Delay & Jitter Features • Installation • Usage • Examples • Configuration • License 🎯 About DonPwner is an advanced penetration testing tool that revolutionizes...

win-brute-logon

Notice 1: We are excited to announce that our current tool has been ported to a PowerShell version. This means that users can now access and use the tool directly from the PowerShell command line, making it even more convenient and efficient to use. We believe that this new version will greatly...

SharpSpray

SharpSpray SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from...

SharpHose

Overview SharpHose is a C password spraying tool designed to be fast, safe, and usable over Cobalt Strike's execute-assembly. It provides a flexible way to interact with Active Directory using domain-joined and non-joined contexts, while also being able to target specific domains and domain...

TREVORspray

TREVORspray 2.0 TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more! By @thetechr0mancer Installation: root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray...

smartbrute

Description The smart password spraying and bruteforcing tool for Active Directory Domain Services. ⚠️ This project works. But the filthy coding makes it more PoC than a stable tool. I may or may not rewrite this in the future, but at least you have everything here to work with bruteforce on any...

CVE-2021-3754

CVE-2021-3754 This repository documents Vulnerability details and exploit for CVE-2021-3754 discovered and reported by myself on 21st August 2021 Metrics CWE-20: Improper Input Validation CVSS: 5.3 MEDIUM Description A flaw was found in Apache Keycloak & Redhat SSO where an attacker is able to...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

POC-CVE-2022-30600

Proof of concept for CVE-2022-30600 Overview This repository contains 2 implementations for a proof of concept which exploits CVE-2022-30600. CVE-2022-30600 is a security vulnerability which allows an attacker to bypass the account lockout threshold within the moodle webapp. As outlined by the...

CVE-2020-15931

CVE-2020-15931 Netwrix Account Lockout Examiner 4.1 ドメイン管理者アカウント資格情報開示の脆弱性 脆弱性概要 Netwrix Account Lockout Examiner ALE 5.1 より前のバージョンでは、認証されていないリモートの攻撃者が、攻撃者が制御するシステムへの接続を誘発し、ドメイン管理者権限を持つアカウントの NTLMv1/v2 チャレンジレスポンスを取得できます。ドメイン管理者アカウントは、インストールに必要な設定として製品にすでに構成されていることになります。攻撃者は、ドメインコントローラ上で Kerberos...

Tritium

Tritium 유효한 Active Directory 계정을 Kerberos 사전 인증을 통해 열거하고 스프레이하는 도구입니다. 배경 현재 시장에는 많은 Kerberos 비밀번호 스프레이 도구가 존재하지만, 다음과 같은 내장 기능을 가진 도구를 찾기가 어려웠습니다: 사용자가 도메인 잠금을 방지하는 기능 비밀번호 스프레이 프로세스에 사용자 이름 열거를 통합하는 기능 사용자 열거는 스프레이와 별도의 기능입니다 한 번에 하나의 스프레이를 실행하는 대신 비밀번호를 재귀적으로 스프레이하는 기능 비밀번호 스프레이를 재개하고 이전에 손상된...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray SecureWorks が最近公表した Azure Active Directory のパスワードブルートフォース脆弱性の POC 説明 このコードは、最近明らかにされた Azure Active Directory のパスワードブルートフォース脆弱性の概念実証です。この脆弱性は Secureworks が発表 しました（また、公式発表の約1日前に公開された Ars Technica の記事 もほぼ同じ内容です）。 理論上、この手法を使用すると、1つ以上の AAD...

CVE-2026-84461

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even...

EUVD-2026-87267

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: セッションスコープのOTPロックアウトによる2FAバイパス WordPress用のminiOrange Two-Factor Authenticationプラグインにおける認証バイパスにより、被害者の有効なパスワードをすでに入手している攻撃者が、第2要素を無制限にブルートフォースでき、2FAを完全に無効化できる。 概要 | ---|--- CVE ID| CVE-2026-77771 脆弱性の種類| 認証バイパス AUTHBYPASS CWE| CWE-287: 不適切な認証 OWASP Top 10...

FaceBrute

FaceBrute Facebook ブルートフォーススクリプト このスクリプトは、指定した facebook アカウントに対して、 パスワードリスト（辞書）を使用してパスワードを推測しようとします。 facebook はログインに継続的に失敗するアカウントへのアクセスを一時的にブロックするため、 このスクリプトは、それが発生した場合に アカウントのロックが解除されるまで指定された時間待機するように コーディングされています。 このソフトウェアは、著作権所有者および貢献者によって 「現状のまま」提供され、明示または黙示を問わず、 商品適格性および特定目的への適合性の黙示保証を含め、...

DEBIAN-CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...