vortex

🚩 This is the public repository of vortex, for latest version and updates please consider supporting us through https://porchetta.industries/ Vortex VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit 🚩 Sponsors If you want to sponsors this project and have the latest update...

TREVORspray

TREVORspray 2.0 TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more! By @thetechr0mancer Installation: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray See the...

SharpSpray

SharpSpray SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from...

spraygen

Spraygen Password list generator for password spraying - prebaked with goodies Version 1.7 Generates permutations of Months, Seasons, Years, Sports Teams NFL, NBA, MLB, NHL, Sports Scores, "Password", and even Iterable Keyspaces of a specified size. All permutations are generated with common...

RDWAtool

A python all-in-one tool to extract information, spray and bruteforce passwords on a Microsoft Remote Desktop Web Access RDWA application. This python tool allows to extract various information from a Microsoft Remote Desktop Web Access RDWA application, such as the FQDN of the remote server, the...

Tritium

Tritium A tool to enumerate and spray valid Active Directory accounts through Kerberos Pre-Authentication. Background Although many Kerberos password spraying tools currently exist on the market, I found it difficult to find tools with the following built-in functionality: The ability to prevent...

SharpSpray

SharpSpray This project is a C port of my PowerSpray.ps1 script. SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike. https://github.com/jnqpblc/Misc-PowerShell/blob/master/PowerSpray.ps1 By default it wi...

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

The U.S. Federal Bureau of Investigation FBI and Secret Service USSS on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer SSL virtual private network VPN gateways. "The campaign...

ActiveReign

ActiveReign ⚠️ Thank you for your support. This project is no longer publicly maintained. Background A while back I was challenged to write a discovery tool with Python3 that could automate the process of finding sensitive information on network file shares. After writing the entire tool with...

Oh365UserFinder

Oh365 User Finder v1.1.2 Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

msprobe

msprobe 关于 安装 使用方法 示例 即将推出 致谢 关于 发现所有本地部署的微软产品，用于密码喷洒和枚举。 该工具将使用与目标根域名相关的常见子域名列表，尝试发现有效的本地部署微软解决方案实例。以下是工具运行时的截图： 安装 使用 pipx 安装该项目 pipx install git+https://github.com/puzzlepeaches/msprobe.git 使用方法 该工具包含四个不同的模块，用于协助发现本地部署的微软产品： Exchange RD Web ADFS Skype for Business 帮助菜单和支持的模块如下所示： Usage: msprob...

TeamFiltration

TeamFiltration TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has bee...

spraycharles

Spraycharles hey, yo I'm feeling like spraycharles - Chiddy Bang Low and slow password spraying tool, designed to spray on an interval over a long period of time. Includes spraying plugins for Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix Netscaler, Sonciwall, NTLM over HTTP, and SMB...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

Invoke-CleverSpray

Invoke-CleverSpray Password Spraying Script detecting current and previous passwords of Active Directory User by @flelievre Options: -Password: Password to spray. -PasswordFile: Path to file containing a list of passwords to spray. -Username: samAccountName of the user to target. -UsernamesFile:...

chalumeau

Chalumeau Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own Payloads In-Memory execution Extract Password List Dashboard reporting / Web Interface Parsing Mimikatz Dumping Tickets Screenshots Known Issues Parsin...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

adfsbrute

adfsbrute 一个用于针对 Active Directory 联合身份验证服务 ADFS 测试凭据的脚本，可自动计算组织的 ADFS URL，并支持密码喷洒或暴力破解攻击。 主要思路是：在每次测试之间加入随机且较长的时间延迟，并使用代理列表或 Tor 来增加蓝队检测难度，从而实施密码喷洒攻击。同时也支持暴力破解，或测试 用户名:密码 格式的凭据（例如来自 Pwndb 的数据）。已测试过的登录信息会存储在日志文件中，避免重复测试。 使用 ./adfsbrute.py -t TARGET -u USER -U USERLIST -p PASSWORD -P PASSWORDLIST -...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...