#1Password cracking, brute-force, wordlists, and credential testing tools.
Kitploit recommended
localh0t/m4ngl3m3Common password pattern generator using strings list
treebuilder/aad-sso-enum-brute-sprayPOC of SecureWorks' recent Azure Active Directory password brute-forcing vuln
nicholasaleks/crackqlGraphQL penetration testing tool that exploits weak rate limits and cost analysis to brute-force credentials, bypass 2FA, enumerate users, and fuzz…
0xedh/dumpguard_bofBeacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems.
danmcinerney/device-pharmerOpens 1K+ IPs or Shodan search results and attempts to login
blacklanternsecurity/offensive-azureCollection of offensive tools targeting Microsoft Azure
jas502n/cve-2019-2618Exploit script for CVE-2019-2618, a Weblogic arbitrary file upload vulnerability, with JSP webshell deployment and encrypted credential decryption.
m8sec/enumdbRelational database brute force and post exploitation tool for MySQL and MSSQL
k4m4/dymerge🔓 A dynamic dictionary merger for successful dictionary based attacks.
noptrix/sshprankA fast SSH mass-scanner, login cracker, banner grabber and password auth checker tool using the python-masscan and shodan module.
dafthack/check-localadminhashCheck-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine…
mrd0x/webview2-cookie-stealerInjects JavaScript keylogger into WebView2 pages to capture keystrokes and exfiltrate cookies from Microsoft authentication sessions via HTTP GET…
xpn/randomtsscriptsCollection of RedTeam engagement scripts including Pre2K default credential checks via TGS, LAPSv2 password decryption, and IIS App Pool credential…
rubenformation/ms-photos_ntlm_leakNew 0 day vulnerability allowing to leak NTLM hashes from browsers with one click
offensive-panda/lsassreflectdumpingThis tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created,…
an0nlk/nosql-mongodb-injection-username-password-enumerationUsing this script, you can enumerate Usernames and passwords of Nosql(mongodb) injecion vulnerable web applications.
ricardojoserf/adfsbruteA script to test credentials against Active Directory Federation Services (ADFS), allowing password spraying or bruteforce attacks.
