7925 matches found
whatsapp-census
Hey there! You are using WhatsApp This is the github repository for the extended version of the paper Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy. Abstract WhatsApp, with 3.5 billion active accounts as of early 2025, is the world's largest instan...
CVE-2025-56643
CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...
Cr3dOv3r
Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...
faraday_plugins
Install pip install faraday-plugins Commands List Plugins List all plugins and if its compatible with command or/and report Optional params: -cpf / --custom-plugins-folder PATH: If given will also look for custom plugins on that path faraday-plugins list-plugins Test autodetect plugin from comman...
CVE-2024-41958-PoC
CVE-2024-41958-PoC Esta es una pequeña prueba de concepto para CVE-2024-41958. Es posible eludir la autenticación TFA en el panel de administración. Versiones afectadas: 2024-07 Requisitos previos necesarios para que funcione el CVE: Password y username para una cuenta sin TFA. Password y usernam...
SocialPath
SocialPath Track users across social media platforms Deanonymizing darknet users by username reuse Research no. 2 in progress Supported services: Facebook Twitter + details Stackoverflow + details Instagram + details Reddit + details Steam Pinterest Tumblr Pastebin Github Requirements: Django...
Pwdb-Public
PWDB - Nueva generación de análisis masivo de contraseñas Objetivo Dejando atrás las cosas de hace 20 años del red team. Las cosas funcionan bien, y nadie se molesta en revisarlas/reemplazarlas durante décadas. Dumps incluidos Puedes consultar el archivo status.txt en este repositorio para hacer...
CVE-2026-25645
CVE-2026-25645 Insecure Temporary File Reuse in requests.utils.extractzippedpaths Executive Summary A vulnerability was identified in the requests library Python within the public utility function requests.utils.extractzippedpaths. The function utilizes a predictable, non-unique filename when...
pentest_teamcity
Pentest TeamCity usando Metasploit TL;DR: Obtener contraseñas deJetBrains IDE como IntelliJ o PyCharm y usar esas credenciales dentro de TeamCity Continuous Integration Server para obtener una sesión de meterpreter en el servidor y agentes de compilación usando metasploit por Kacper Szurek...
credmap
credmap: El Mapeador de Credenciales Credmap es una herramienta de código abierto creada para concienciar sobre los peligros de la reutilización de credenciales. Es capaz de probar las credenciales de usuario proporcionadas en varios sitios web conocidos para comprobar si la contraseña ha sido...
credmap
credmap: The Credential Mapper Credmap is an open source tool that was created to bring awareness to the dangers of credential reuse. It is capable of testing supplied user credentials on several known websites to test if the password has been reused on any of these. An official introductionary...
crauEmu
Mascot designed by@kottsarapkin crauEmu is an uEmu extension for developing and analyzing payloads for code-reuse attacks. Slides from ZeroNights 2019 Demo 1 - X32-64, Edge, rop-gadgets from pwnjs Demo 2 - ARM64, checkm8 callback-chain RopEditor Installation 1. Put the file crauEmu.py in same...
mssqlproxy
mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...
CVE-2020-24030
CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...
CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-
CVE-2026-11117 – Reinstalación del handshake de 4 vías en WPA2 Simulación de KRACK Código del programa Python kracksim.py - Simulates reinstallation of an already-used PTK import hashlib, os class AccessPoint: def initself: self.anonce = os.urandom32 self.ptk = None def sendmsg3self, snonce:...
CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery
CVE-2026-11110 – Reutilización de Nonce en AES-GCM que Conduce a la Recuperación de Claves Código del Programa Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def...
CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp
CVE-2026-21002 – Fuga de credenciales en arranque en frío de funciones serverless mediante reutilización de /tmp Código del programa simulación de AWS Lambda en Python lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm...
CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing
CVE-2026-21009 – Reutilización de nonce ECDSA en el firmado de firmware IoT Código del programa Python ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images...
CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay
CVE-2026-21010 – Replay de autenticación digest SIP en VoIP Código del programa simulador SIP en Python sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set...
