mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

CVE-2022-30216

CVE-2022-30216 A Zeek package which raises notices for attempts and exploits of CVE-2022-30216, a technique used against Windows Server to force an NTLM authorization to an arbitrary server. An attacker can reuse the NTLM token to generate a client certificate, enabling them to request a Kerberos...

CVE-2025-4404-POC

CVE-2025-4404 POC POC for CVE-2025-4404 If you have a domain computer account host/[email protected], then you can add the service by default. And you can set krbPrincipalName and krbCanonicalName. By default, the krbCanonicalName attribute value is missing for the FreeIPA 4.12.4...

CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

ntlmv1-multi

NTLMv1 Multi Tool This tool reverses NTLMv1 hashes to NTLM, or more specifically it formats NTLMv1 challenge responses into a format that can be cracked with hashcat mode 14000 CT3 calculation If you specify --ct3 it will calculate the the final 4 digits of the NTLM for you, if you specify --json...

kerberoast

kerberoast Kerberoast is a series of tools for attacking MS Kerberos implementations. Below is a brief overview of what each tool does. Extract all accounts in use as SPN using built in MS tools PS C:\ setspn -T medin -Q / Request Tickets One ticket: PS C:\ Add-Type -AssemblyName...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory Exploitation Cheat Sheet This cheat sheet contains common enumeration and attack methods for Windows Active Directory. ℹ️ This repository was created by Nikos Katsiopis and Nikos Vourdas. This cheat sheet is inspired by the PayloadAllTheThings repo. Summary Active Directory...

WonkaVision

WonkaVision WonkaVision is a proof of concept POC tool to analyze Kerberos tickets and attempt to determine if they are forged. This tool was created by Charlie Clark and Andrew Schwartz. It should be noted that this POC is not intended to be a production-ready enterprise application, but rather ...

kcmdump

KCM dumper Quick script to dump the KCM database used by SSSD and recover Kerberos tickets in the CCACHE format. Initially based on SSSDKCMExtractor and KCMTicketFormatter. Description Since version 2.0.0 2018-08-13, the back end storage of the KCM responder of SSSD does not encrypt the database...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

CVE-2026-36214

CVE-2026-36214 - Stored Cross-Site Scripting XSS in osTicket via Vulnerable Bootstrap Tooltip Component Description Enhancesoft osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 ship with the known-vulnerable Bootstrap Tooltip 3.3.4 component CVE-2019-8331, which introduces a...

CVE-2024-28987

CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credentials Exploit ⚠️ DISCLAIMER: This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. 📋...

Rubeus

Rubeus Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard component...

CVE-2026-11374-check

CVE-2026-11374 ManageEngine AD360 Precondition Detection Script A detection script for the exploit precondition of CVE-2026-11374, a predictable SSO-ticket flaw that leads to unauthenticated account takeover across the ManageEngine AD360 suite. The four in-scope products share the...

CVE-2024-28987

CVE-2024-28987 Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability Overview Extracts up to 25 most recent tickets API limitation Retrieves full details for each ticket Analyzes ticket IDs to estimate total tickets in system Organizes output in ...

Prox-Ez

Prox-Ez: The Swiss Army Knife of HTTP auth This HTTP proxy handles all HTTP authentications on your behalf. It supports NTLM EPA channel binding and service binding, kerberos, pass-the-hash, overpass-the-hash pass-the-key and pass-the-ticket TGT and TGS. Related articles: Dissecting NTLM EPA with...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...

Wonka

Wonka 🍫 "We are the music makers, and we are the dreamers of dreams." - Willy Wonka Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority LSA cache. Like finding a ticket, but for security research and penetration testing! 🎫 ✨ Features 🔐 System...

AutoPtT

AutoPtT AutoPtT enumerates Kerberos tickets and performs Pass-the-Ticket PtT attacks interactively or step by step. It is a standalone alternative to Rubeus or Mimikatz for this attack, implemented in C, C++, Crystal, Python and Rust. You can use the following options: auto - Automated...