#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended

Entra ID user enumeration and auth method discovery via the public GetCredentialType API
The next generation encrypted file sharing project

This repository discloses a server-side authorization bypass in Instagram, which allowed unauthenticated access to private timelines; it seems likely…

Ask the Web Account Manager (WAM) for Entra ID tokens

Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.

POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln

Burp Suite Extension useful to verify OAUTHv2 and OpenID security

eBPF LSM based Mandatory Access Control and jailer

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and…

SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS

CaptainCredz is a modular and discreet password-spraying tool.

cve-2022-23131 zabbix-saml-bypass-exp

Scalable API key server for issuing, verifying, and revoking credentials with token derivation for fine-grained capability tokens. Supports…

Office Anywhere网络智能办公系统

An open-source TPM device-attest-01 CA server

EvilMist is a collection of scripts and utilities designed to support cloud penetration testing & red teaming. The toolkit helps identify…

Microsoft Entra Conditional Access Documentation with PowerShell

CVE-2024-27198 & CVE-2024-27199 Authentication Bypass --> RCE in JetBrains TeamCity Pre-2023.11.4