hash-identifier

hash-identifier 데이터 및 특히 비밀번호를 암호화하는 데 사용되는 다양한 해시 유형을 식별하는 소프트웨어입니다. 지원되는 암호화 형식: ADLER-32 CRC-32 CRC-32B CRC-16 CRC-16-CCITT DESUnix FCS-16 GHash-32-3 GHash-32-5 GOST R 34.11-94 Haval-160 Haval-192 110080 ,Haval-224 114080 ,Haval-256 Lineage II C4 Domain Cached Credentials XOR-32 MD5Half...

stegano

Steganography by bzt Online demo In a nutshell, steganography is the art of hiding messages in another medium in plain sight without people realizing. This implementation reads in images in popular web formats WEBP, PNG, GIF, JPEG, hides the optionally encrypted text in them and saves the result ...

database-druid

druid encode java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools 密码 例: java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools jas502n root@kitploit:...

CSRF-breach

セキュリティ侵害プロジェクト - クロスサイトリクエストフォージェリ Dolibarr 7.0.0 は、クロスサイトリクエストフォージェリ CSRF の影響を受けます。影響: 悪意のあるHTMLにより、ユーザーパスワードの変更、ユーザーの無効化、パスワード暗号化の無効化が可能になります。対象コンポーネント: ユーザーパスワード変更機能、ユーザー無効化機能、パスワード暗号化機能。攻撃ベクトル: 管理者が悪意のあるURLにアクセスすること。 デモンストレーション デモンストレーションの手順 -起動: 'vagrant up' を実行して環境をダウンロードします 当然時間がかかります:...

CVE-2022-25012

Argus Surveillance DVR 4.0 - 脆弱なパスワード暗号化 CVE-2022-25012 この脆弱なパスワード暗号化スクリプトの更新版です Exploit DB 参照: https://www.exploit-db.com/exploits/50130 著者参照: https://deathflash1411.github.io/blog/dvr4-hash-crack NIST 参照: https://nvd.nist.gov/vuln/detail/CVE-2022-25012 説明:...

gpp-encrypt

gpp-encrypt 説明 この小さなスクリプトは、パスワードをgpp cpasswordに暗号化します。脆弱なラボADを作成するのに便利です。 必要条件 このパッケージが必要とするもの: python3 python3 標準ライブラリ インストール root@kitploit: git clone "https://github.com/mauricelambert/gpp-encrypt.git" cd "gpp-encrypt" python3 -m pip install -r requirements.txt 使用方法 コマンドライン root@kitploit: pytho...

CVE-2022-25012

CVE-2022-25012 Argus Surveillance DVR v4.0 employs weak password encryption. Compilation root@kitploit: gcc pocland.c -o pocland Usage Example root@kitploit: ./pocland B4A1ECB4F539C48C7357F641C9C49083 References CVE-2022-25012 More PoCs available at: pocland...

CVE-2022-25012-dvr4-weak-password-encryption

This is an improved version of the exploit by deathflash1411 Original exploit: https://www.exploit-db.com/exploits/50130 Improved Features Cracked password is now output as reconstructed password string instead of only output character by character The encrypted password string is now entered as ...

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap

A flaw was found in the OpenSSL CMS implementation RFC 3211 KEK Unwrap. This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption PWRI...

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel via the authentication process. An attacker can recover user credentials by exploiting timing differences during MD5-hashed password comparison. This is only exploitable if the database contains MD5-hashed password...

CVE-2026-5363 Use of weak cryptographic key in TP-Link Archer C7

Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 uhttpd modules allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An adjacent attacker with the ability to...

CVE-2026-30785 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution', Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbbcommon on Windows, MacOS, Linux Password security module, config encryption, machine U...

CVE-2026-30785

RustDesk Client (through version 1.4.5) is affected by CVE-2026-30785 due to a vulnerability described as Prototype Pollution and weak password hashing in the password_security, config, and machine-uid-related code paths (hbb_common and related modules). The issue can allow Retrieve Embedded Sens...

CVE-2026-30785 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution', Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbbcommon on Windows, MacOS, Linux Password security module, config encryption, machine U...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a vulnerability that could provide weaker than expected security (CVE-2025-13333)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a vulnerability that could provide weaker than expected security when enabling AES-256 password encryption. Vulnerability Details Refer to the security bulletins listed in the...

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap

A flaw was found in the OpenSSL CMS implementation RFC 3211 KEK Unwrap. This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption PWRI...

CVE-2024-52334

A vulnerability has been identified in syngo.plaza VB30E All versions VB30EHF07. The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access...

CVE-2024-52334

A vulnerability has been identified in syngo.plaza VB30E All versions VB30EHF07. The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access...

CVE-2024-52334

CVE-2024-52334 concerns syngo.plaza VB30E (all versions

CVE-2024-52334

A vulnerability has been identified in syngo.plaza VB30E All versions VB30EHF07. The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access...