SMShell

SMShell PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 Disclaimer This is not a complete C2 bu...

fake-sms

Fake-SMS A simple command line tool using which you can skip phone number based SMS verification by using a temporary phone number that acts like a proxy. Latest update : The tool no longer uses upmasked.com, as the service went down. We are using another provider which provides more phone number...

FMD Android

FMD Android Find your device via SMS, instant messengers, or a web interface FMD Server. FMD allows you to locate, ring, wipe and issue other commands to your device when it's lost. It aims to be a secure open source alternative to Google's Find My Device. Why? I lost my brand new phone last week...

signal-without-smartphone

Setup Signal without smartphone A Desktop application to register an account with Signal and link it with Signal Desktop, all without requiring a smartphone. This utility avoids the need of a smart phone, but still requires a way to receive SMS messages during the setup phase. Signal recently...

Chinese-Cybercrime-Research

Chinese Cybercrime Research Resources to learn more about Chinese-language cybercrime actors. Phishing Phishing Kits YYlaiyu https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services https://spycloud.com/blog/yylaiyu-chinese-phishing-as-a-service-panel/...

Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read

An arbitrary file read vulnerability, also known as a "path traversal" or "directory traversal" vulnerability, occurs when an attacker is able to access files on a system that they shouldn't have access to. This vulnerability arises from improper input validation or insufficient access controls i...

Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code

ruoyi-vue-pro Yudao ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant "9999" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed ...

Vaim-sms

Vaim-sms What is Vaim-sms ? This is sms bomber who send otp in target phone number unlimitly. Many times you just want to annoy or play a prank on your friends. If you find yourself in that situation then this SMS Bomber is the perfect tool for you! You can send unlimited SMS to anyone. This...

CVE-2026-120447

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...

SDK-SMS-Stack

SMS Stack Sms Stack is a Framework to provide TPC/IP based characteristics to the GSM Short Message Service. This framework works in multiple environments to provide a full stack integration in a service. The main layer features techniques to control the order and the number of sms for a given...

CVE-2026-120447

The software HotGo through 2.15.1 is susceptible to an authentication bypass vulnerability. An unauthenticated attacker who knows a user's mobile number can supply a custom value to the Code field at the /admin/sms/send endpoint. By pre-setting a known verification code, the attacker can then sig...

EUVD-2026-115207

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...

CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through...

TeleGram-Scraper

Telegram Group Scrapper • API Setup Go to http://my.telegram.org and log in. Click on API development tools and fill the required fields. put app name you want & select other in platform Example : copy "apiid" & "apihash" after clicking create app will be used in setup.py • How To Install and Use...

CVE-2026-57199

A flaw was found in Asterisk. An attacker can trigger a Denial of Service DoS or memory corruption by supplying crafted Short Message Service SMS data to an affected system configured with the SMS dialplan application. This issue occurs because incoming message lengths are copied into fixed...

SMSOTPBOT

ghost-OTPBOT ghost-OTPBOT is the most advanced and versatile OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank. You can use this to get OTP for logins, banks, credit cards, apple pay, and more. Join...

SMSBotBypass

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

CVE-2025-31200-iOS-AudioConverter-RCE

CVE-2025-31200 – iOS AudioConverterService Zero-Click RCE Public disclosure of CVE-2025-31200 – a zero-click remote code execution RCE vulnerability in Apple's iOS 18.X, specifically within the AudioConverterService component. The vulnerability is triggered by a malicious audio file delivered via...

SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

CVE-2025-66947

CVE-2025-66947 Time Based Blind SQL Injection in krishanmuraiji SMS v1.0 ⏱️ Visual comparison: normal response vs 6s delayed response 🔍 Summary TL;DR: A GET parameter in an admin module allows time-based SQL injection via response delays. A 𝗧𝗶𝗺𝗲 𝗯𝗮𝘀𝗲𝗱 𝗯𝗹𝗶𝗻𝗱 𝗦𝗤𝗟 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 exists in...