TOTPAuthenticate

TOTP Authenticate Uses session handling rules to add a TOTP token to outgoing requests. For Burp Suite Enterprise Edition Please note that extensions are written by third party users of Burp, and PortSwigger makes no warranty about their quality or usefulness for any particular purpose. Usage 1...

proxmark3

Iceman Fork - Proxmark3 The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast. Iceman repository is considered to be...

CVE-2026-103977

Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

about_cobaltstrike4.5_cdf

aboutcobaltstrike4.5cdf CobaltStrike 4.5 version cracked, removed checksum8 feature, bypass BeaconEye, fixed error path leaking stage, added TOTP two-factor authentication, fixed CVE-2022-39197, etc. If you are looking for this project: cobaltstrike4.5cdf Yes, it has been taken down again:...

Aegis

Aegis Authenticator Aegis Authenticator is a free, secure and open source 2FA app for Android. It aims to provide a secure authenticator for your online services, while also including some features missing in existing authenticator apps, like proper encryption and backups. Aegis supports HOTP and...

hotpot

Hotpot 🍲 Authy / Google Authenticator for the command line. Hotpot is a simple and secure command-line tool for managing TOTP-based two-factor authentication codes. Hotpot securely stores your 2FA secrets in your system's keyring and generates time-based one-time passwords when you need them. Bui...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE Improvised Description Exploits a pre-auth NoSQL injection vulnerability in Rocket.Chat 3.12.1 to leak the admin's TOTP secret and password reset token, take over the admin account, and achieve RCE via a malicious webhook integration. Affected Version...

totp-ssh-fluxer

TOTP SSH port fluxing Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in...

joombrute

JoomBrute Modern Joomla auth-attack toolkit J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227 Description Joomla credential-attack toolkit covering CMS versions 3, 4, and 5. Six subcommands handle the full attack chain end-to-end: detect - version fingerprint manifest XML → generato...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

cobaltstrike4.5_cdf-1

cobaltstrike4.5cdf Crack cobaltstrike4.5, remove checksum8 feature, bypass BeaconEye, fix stage leakage via wrong path, add TOTP two-factor authentication, add encrypted username display, fix foreign spawn bug in 4.5, rename client configuration file, etc. cobalt strike4.5 crack cobaltstrike4.5...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728

Versions of Bulwark Webmail prior to 1.9.2 are vulnerable to a DNS-rebinding SSRF in the public POST /api/fetch-ical endpoint. The root cause is a check-then-fetch pattern where the application performs one DNS lookup for validation and a second lookup for the socket connection; an attacker contr...

GO-2026-6786 TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI...

GO-2026-6722 Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api

Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

CVE-2026-111905

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111882

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111886

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...