certdepot

Certificate Depot A free online tool for generating self-signed SSL/TLS certificates in seconds. No signup required. Website: cert-depot.com Features Generate self-signed certificates with RSA 2048/4096 or ECDSA P-256/P-384 keys Download as ZIP PEM key + certificate or PFX PKCS12 Automatic SAN...

whatsapp-census

Hey there! You are using WhatsApp This is the github repository for the extended version of the paper Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy. Abstract WhatsApp, with 3.5 billion active accounts as of early 2025, is the world's largest instan...

fb_friend_list_scraper

Facebook Friend List Scraper OSINT tool to scrape names and usernames from large friend lists on Facebook, without being rate limited. hmu on Mastodon: @[email protected] Getting started: Install using pip: python -m pip install fb-friend-list-scraper Script is now installed as...

Zen

Find email addresses of Github users Find email address of a user python zen.py username or python zen.py https://github.com/username Find email addressess of contributors of a repository python zen.py https://github.com/username/repository Find email addresses of members of an organization pytho...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

CVE-2019-19633

CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...

CVE-2020-35590

漏洞利用信息 漏洞标题： WordPress 插件 Limit Login Attempts Reloaded 2.13.0 - 登录限制绕过 CVE： CVE-2020-35590 日期： 2020-06-09 漏洞作者： N4nj0 软件链接： https://wordpress.org/plugins/limit-login-attempts-reloaded/ 版本： 2.13.0 测试环境： WordPress 5.4.1, 5.4.2 漏洞公告：...

subbrute

subdomain-bruteforcer SubBrute SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting...

lua-resty-limit-traffic

名称 lua-resty-limit-traffic - 用于在 OpenResty/ngxlua 中限制和控制流量的 Lua 库 目录 名称 状态 示例 描述 安装 社区 英文邮件列表 中文邮件列表 Bug 与补丁 作者 版权与许可证 参见 状态 这个库已经可以使用，尽管仍处于高度实验阶段。 Lua API 仍处于变动之中，并且可能在不久的将来恕不另行通知地发生变化。 示例 root@kitploit: demonstrate the usage of the resty.limit.req module alone! http luashareddict mylimitreqstor...

filtron

Filtron 反向HTTP代理，用于按不同规则过滤请求。可用于生产Web服务器和应用服务器之间，防止对应用后端的滥用。 此程序的初衷是保护 searx，但可用于守护任何Web应用。 安装与设置 root@kitploit: $ go install github.com/asciimoo/filtron $ "$GOPATH/bin/filtron" --help 规则 一个规则有两个必需属性：name 和 actions 一个规则可以包含以下所有属性： limit 整数 - 定义在 interval 秒内允许多少个匹配请求访问应用。（如果为 0 可省略） interval 整数 -...

meg

meg megは、多数のURLを取得しながらも、サーバーに対して「優しく」振る舞うためのツールです。 多くのホストに対して多くのパスを取得するために使用できます。すべてのホストに対して1つのパスを取得してから、次のパスに移り、それを繰り返します。 結果は大量に素早く得られますが、個々のホストがトラフィックで溢れることはありません。 インストール megはGoで書かれており、実行時の依存関係はありません。Go 1.9以降がインストールされ設定されていれば、go installでmegをインストールできます。 root@kitploit: ▶ go install...

net-Shield

net-Shield An Easy and Simple Anti-DDoS solution for VPS,Dedicated Servers and IoT devices based on iptables/ipsets Requirements Linux System with golang, iptables/ipsets Nginx Quickstart Run the bash script install.sh to install all the required dependencies. bash install.sh You will be prompted...

limitrr-php

使用 PHP 和 Redis 进行轻量级限流。 Limitrr PHP 在很大程度上受到了我为 NodeJS 创建的另一个库 Limitrr 的启发。点击这里查看。 Limitrr PHP 允许用户轻松地在应用中集成速率限制。与其他类似的包不同，该工具不仅允许用户按请求数量进行限制，还可以按已完成操作的数量进行限制（例如允许在一个时间段内成功创建一定数量的账户），并可配合自定义选项对其进行限制。此外，它还支持自定义标识符——你不再需要仅根据用户 IP 进行限制。 该库还提供了一个中间件函数，可让你轻松地对 SlimPHP 项目中可能存在的各种路由进行限流。 如果你喜欢这个项目，请在...

CVE-2024-57610

Sylius v2.0.2におけるレート制限の欠如 ベンダーホームページ: https://sylius.com/ 再現手順 1.https://store.sylius.com/login にアクセスします。 2.自動化ツールまたはスクリプト（例：Burp Suite、cURL）を使用して、複数のログインリクエストを試みます。 3.レート制限が適用されておらず、リクエストが制限なしに処理されることを確認します。 PoC動画 https://drive.google.com/file/d/1o5nd8eStt0tgBpKJHUay02NHVAUntPM/view 画像...

CVE-2026-90562

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562

LangBot before 4.10.11 is vulnerable to authentication bypass via a weak password recovery key mechanism. The application generates recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. A remote attacker who knows the administrator...

EUVD-2026-76987

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

PT-2026-90833

CVE-2026-90562 isn't a prompt injection zero-day. it's a password reset bug straight out of the OWASP Top 10 circa 2005, wearing an "agentic AI" badge. LangBot orchestrates LLM agents across Discord, Telegram, Slack bridges. the CVE lets an attacker hit the password reset endpoint and walk straig...

CVE-2026-8793

CVE-2026-8793 — Missing Brute-Force Protection on PaperCut NG Login Form Field| Details ---|--- CVE ID| CVE-2026-8793 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS Score| 5.3 Medium — standalone...