Go365

Go365 v2.0 Risolti problemi con il gateway AWS grazie h0useh3ad! Non si blocca più quando le connessioni al server proxy falliscono Aggiunto l'endpoint graph Si prega di leggere tutto questo README prima di usare Go365! Go365 è uno strumento progettato per eseguire enumerazione degli utenti e...

brutto

brutto Einfaches Brute-Forcing für alles, was du willst, mit magischen steigenden Werten und direktem Vorgehen. Implementierung Klonen: git clone https://github.com/jofpin/brutto.git Die neueste Version herunterladen Mit Python installieren: python setup.py install root@kitploit: So importierst d...

Shreder

Shreder Shreder ist ein leistungsstarkes, multithreaded SSH-Protokoll-Passwort-Brute-Force-Tool. Funktionen Sehr schnelles Passwort-Raten, nur ein Passwort in 0.1 Sekunde. Optimiert für große Passwortlisten, Shreder versucht 1000 Passwörter in 1 Minute und 40 Sekunden. Einfache CLI- und...

PassGAN

PassGAN Dieses Repository enthält den Code für das Paper PassGAN: A Deep Learning Approach for Password Guessing. Das Modell von PassGAN stammt aus Improved Training of Wasserstein GANs und es wird angenommen, dass die Autoren von PassGAN in ihrer Arbeit die improvedwgantraining...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: Kein Rate-Limiting bei /login ermöglicht unbegrenzte Passwort-Brute-Force-Angriffe Produkt: dgtlmoon/changedetection.io — v0.55.7 Datei: changedetectionio/flaskapp.py CWE: CWE-307 — Unzureichende Beschränkung übermäßiger Authentifizierungsversuche CVSS 3.1:...

win-brute-logon

सूचना 1: हमें यह घोषणा करते हुए खुशी हो रही है कि हमारे वर्तमान टूल को PowerShell संस्करण में पोर्ट किया गया है। इसका मतलब है कि उपयोगकर्ता अब PowerShell कमांड लाइन से सीधे टूल तक पहुँच सकते हैं और उसका उपयोग कर सकते हैं, जिससे यह और भी अधिक सुविधाजनक और कुशल हो जाता है। हमारा मानना है कि यह नया...

Talon

QUESTO REPOSITORIO È STATO ARCHIVIATO Per visualizzare l'ultima versione di Talon o per inviare una segnalazione, fare riferimento a https://github.com/Tylous/Talon. Talon Talon è uno strumento progettato per eseguire attacchi automatici di indovinamento delle password rimanendo non rilevato. Tal...

CVE-2026-81704

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The affected code uses unstretched SHA-256 instead of Argon2id , omitting key stretching and hash rounds. This allows attackers to perform offline password guessing ag...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81689 openssl_encrypt before 1.4.9 Weak Pepper Key Derivation

opensslencrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide...

CVE-2026-81689

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, resulting in identical keys across all users and files. An attacker with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wi...

EUVD-2026-67045

opensslencrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide...

CVE-2026-44596

CVE-2026-44596 — YAMCS Assenza di limitazione della frequenza sull'endpoint di autenticazione Riepilogo L'endpoint di autenticazione POST /auth/token in yamcs-core è privo di qualsiasi forma di limitazione della frequenza, blocco dell'account o limitazione dei tentativi falliti. Un attaccante...

CVE-2026-53762

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-53762

VeraCrypt non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND contain a key-derivation flaw in src/Crypto/wolfCrypt.c. The functions derive_key_sha256 and derive_key_sha512 discard the configured iteration count and substitute wc_HKDF for PBKDF2-HMAC , meaning increasing the PIM or...

CVE-2026-53762 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-19611

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...

BIT-GHOST-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

PT-2026-73052

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An improper restriction of excessive authentication attempts exists in the 'authFilePublishAccess' endpoint. This allows unauthenticated attackers to perform brute-force attacks against per-notebook...