sign-saboteur

SignSaboteur SignSaboteur is a Burp Suite extension for editing, signing, verifying, and attacking signed tokens. It supports different types of tokens: Django TimestampSigner, ItsDangerous Signer, Express cookie-session middleware, OAuth2 Proxy, Tornado’s signed cookies, Ruby Rails Signed cookie...

IMDSpoof

IMDSPOOF IMDSPOOF is a cyber deception tool that spoofs an AWS IMDS service. One way that attackers are able to escalate privileges or move laterally in a cloud environment is by retrieving AWS Access keys from the IMDS service endpoint located at...

wardn

wardn A credential firewall for AI agents. The headline claim is structural, not policy: agents receive placeholder tokens, never real API keys. The real key crosses only one network seam — inside the wardn proxy, on its way to the upstream API — and is stripped from responses before they reach t...

spacesiren

SpaceSiren SpaceSiren هو مدير رمز العسل ونظام تنبيه لـ AWS. باستخدام هذا التطبيق الخالي من الخوادم بالكامل، يمكنك إنشاء وإدارة رموز العسل على نطاق واسع - حتى 10,000 لكل مثيل SpaceSiren بتكلفة تكاد تكون معدومة.1 كيف يعمل يوفر SpaceSiren واجهة برمجة تطبيقات API لإنشاء مستخدمين IAM في AWS بدون صلاحي...

token-reverser

Token Reverser Words list generator to crack security tokens. Installation root@kitploit: $ git clone https://github.com/dariusztytko/token-reverser.git Example use case 1. You are testing reset password function 2. Reset password token was sent to your email box e.g...

token-reverser

Token Reverser مولّد قوائم كلمات لاختراق رموز الأمان. التثبيت root@kitploit: $ git clone https://github.com/dariusztytko/token-reverser.git مثال استخدام 1. أنت تختبر وظيفة إعادة تعيين كلمة المرور 2. تم إرسال رمز إعادة تعيين كلمة المرور إلى صندوق بريدك الإلكتروني مثلًا:...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

openCRX-CVE-2020-7378

openCRX-CVE-2020-7378 Unauthenticated Account Take Over Exploits Password Reset Vulnerability in OpenCRX, CVE-2020-7378. A Stealthy Python Implentation for CVE-2020-7378 Exploit is because, the developers used Random Class from java.util.Random to generate random tokens in order to reset a users...

dex

dex - Un fournisseur OpenID Connect fédéré Dex est un service d'identité qui utilise OpenID Connect pour piloter l'authentification d'autres applications. Dex agit comme un portail vers d'autres fournisseurs d'identité via des "connecteurs". Cela permet à dex de déléguer l'authentification à des...

shhgit

🚨 لم يعد يتم صيانة shhgit. إذا كنت بحاجة إلى دعم أو استشارة لجهود فحص الأسرار الخاصة بك، أرسل لي بريدًا إلكترونيًا [email protected] 🚨 يساعد shhgit فرق التطوير والعمليات والأمن ذات التفكير المستقبلي في تأمين أعمالهم من خلال اكتشاف الأسرار عبر شفراتهم قبل أن تؤدي إلى اختراق أمني. تسريب الأسرا...

SEDATED

The SEDATED® Project Sensitive Enterprise Data Analyzer To Eliminate Disclosure focuses on preventing sensitive data such as user credentials and tokens from being pushed to Git. Table of Contents Purpose Setup Clone down SEDATED® Update .example files Customize /config/customconfigs.sh variables...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

talos

Чат · Обсуждения · Новостная рассылка · Документация · Попробуйте Ory Network · Вакансии Ory Talos — это масштабируемый и безопасный сервер API-ключей, оптимизированный для проверки с низкой задержкой, горизонтального масштабирования и предсказуемой эксплуатации. Он следует устоявшимся лучшим...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

peirates

Peirates ما هو Peirates؟ Peirates، أداة اختبار اختراق لـ Kubernetes، تتيح للمهاجم تصعيد الصلاحيات والتنقل عبر مجموعة Kubernetes. تعمل على أتمتة التقنيات المعروفة لسرقة وجمع رموز حسابات الخدمة، والأسرار، والحصول على تنفيذ برمجي إضافي، والسيطرة على المجموعة. أين أقوم بتشغيل Peirates؟ تقوم بتشغيل...

M365Pwned

M365Pwned Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API. Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required. Tool| Target| What it does ---|---|---...

coalmine

Cloud Canary Token Management — Deploy, monitor, and rotate deceptive credentials across AWS and GCP to detect unauthorized access. !WARNING Alpha Version — Coalmine is in early development. Basic functionality is the current priority, and the application should not be considered fully security...

CVE-2026-61608

SolidInvoice , an open-source invoicing platform, is affected by a flaw in its UserInvitation entities prior to version 3.0.1 . The root cause is the absence of an expiry timestamp on invitation tokens, causing mailed invitation links to remain valid indefinitely. An attacker who obtains a leaked...

CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...

Krawl

Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...