aws-key-disabler

AWS Lambda - IAM Access Key Disabler The AWS Key disabler is a Lambda Function that disables AWS IAM User Access Keys after a set amount of time in order to reduce the risk associated with old access keys. AWS Lambda Architecture SysOps Output for EndUser Developer Toolchain Current Limitations A...

OSTE-Web-Log-Analyzer

OSTE-Web-Log-Analyzer 使用 Python Web 日志分析器自动化分析 Web 服务器日志的过程。这款强大工具旨在通过识别和检测服务器日志中的各种网络攻击来增强安全性。通过以下功能领先于潜在威胁： 目录 功能 未来功能 安装 使用 贡献 许可证 功能 1. 攻击检测：识别并标记潜在的跨站脚本（XSS）、本地文件包含（LFI）、远程文件包含（RFI）及其他常见的 Web 应用攻击。 2. 速率限制监控：检测短时间内多次请求的可疑模式，帮助识别暴力破解攻击或自动化扫描工具。 3. 自动扫描器检测：通过识别与已知自动化扫描工具或漏洞扫描器相关的请求，保障 Web 应用安全...

GoMapEnum

该项目最初是为了学习Golang并将在渗透测试中遇到的不同枚举或爆破用户的方法整合在一起而编写的。如果您发现任何错误，请随时提交issue，我将尽力修复或改进工具。 GoMapEnum 没有新内容，但将现有技术整合到一个工具中。 以下截图已过时，命令行也已更改 描述 摘要 推荐使用o365模块进行用户枚举和密码爆破/喷洒。还可以获取附加信息，以避免账户锁定，了解密码虽然正确但已过期、是否启用了MFA等。 LinkedIn 该模块应用于检索电子邮件地址列表，随后通过用户枚举模块进行验证。将在LinkedIn上搜索公司，并返回在这些公司工作的所有人员（按指定格式）。...

telegram-osint-lib

Telegram OSINT 场景库 描述 网上有很多 Telegram API 库，但没有任何一个库演示如何执行复杂场景，例如从频道下载所有照片、监控用户在线状态或注册新账户。本项目旨在改善这一现状：现在您可以轻松创建新场景，并一键执行现有场景。 使用官方 Android 客户端的 Telegram API。 设计原理 Telegram 协议 https://core.telegram.org/ 提供了技术详尽且完整的文档，但并未涵盖使用场景。我们的目标是制作一个库，实现一些真实的 OSINT 使用场景，包括： 在特定群组中搜索用户； 解析群组成员； 监控用户在线状态； 从频道下载照片...

UPGer

UPGer | CVE-2022-4060 - 用户帖子相册 自动批量检测CVE-2022-4060漏洞的工具 - WordPress插件：User Post Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 使用方法 bash upger.sh yourlist.txt thread 参考 https://nvd.nist.gov/vuln/detail/CVE-2022-4060...

wssip

This repository does not have a README...

kraken

Kraken is a simple cross-platform Yara scanner that can be built for Windows, Mac, FreeBSD and Linux. It is primarily intended for incident response, research and ad-hoc detections not for endpoint protection. Following are the core features: Scan running executables and memory of running process...

bmc_bladelogic

BMC Bladelogic RSCD 远程利用（Linux 和 Windows） 更改密码、列出用户和远程代码执行 利用 BMC BladeLogic RSCD 代理中的漏洞 CVE-2016-1542 BMC-2015-0010 CVE-2016-1543 BMC-2015-0011 CVE-2016-5063 已发布在 exploit-db BMCrexec.py https://www.exploit-db.com/exploits/43902/ BMCwinUsers.py https://www.exploit-db.com/exploits/43934/ BMCrexec....

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...

wavecrack

Wavecrack 描述 一个用户友好的Web界面，用于在多用户之间共享一个hashcat破解箱，并提供一些预定义选项。 截图 主页 添加要破解的哈希值 查看结果和统计信息 概述 这个Web应用程序可用于使用hashcat启动异步密码破解 。 界面力求尽可能用户友好 ，方便选择密码破解方法，并自动执行各种攻击模式的顺序 。 它还显示已破解密码的统计信息 ，并允许以CSV格式导出已破解密码列表 。 该应用程序设计用于多用户环境，不同用户的破解结果之间严格隔离 ：用户认证可以通过LDAP目录或基本认证 完成。 用法 Wavecrack可用于执行以下操作：...

Adobe ColdFusion - Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

LiquidFiles < 4.2 - User Enumeration via Password Reset

LiquidFiles filetransfer server before 4.2 contains a user enumeration vulnerability caused by distinguishable responses in password reset functionality, letting unauthenticated attackers enumerate valid user accounts, exploit requires no authentication. id: CVE-2025-56132 info: name: LiquidFiles...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...