Tools

jenderal92/wp-def

Wordpress Default Password

saykino/cve-2026-31282

Proof-of-concept for CVE-2026-31282: Totara LMS login page access control bypass enabling unauthenticated brute-force credential attacks. Includes…

anmolksachan/waybacklister

A New Approach to Directory Bruteforce with WaybackLister v1.0

gh-ost00/cve-2024-28987-poc

Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)

njmbb8/cve-2024-42850

An issue in Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.

soy-oreocato/cve-2022-42176

Proof-of-concept for CVE-2022-42176: hard-coded credentials in PCSecure configuration file allow local privilege escalation to admin panel and…

m0rtem/cloudfail

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

leekenghwa/cve-2023-37756-cwe-521-lead-to-malicious-plugin-upload-in-the-i-doit-pro-25-and-below

Proof-of-concept for CVE-2023-37756: weak password requirements in i-doit Pro admin-center enabling brute-force login and malicious plugin upload…

leekenghwa/cve-2023-37755---hardcoded-admin-credential-in-i-doit-pro-25-and-below

Proof-of-concept for CVE-2023-37755: hardcoded admin credentials (admin/admin) in i-doit Pro 25 and below, enabling unauthorized admin login via the…

hakaioffsec/navgix

Multi-threaded Go tool to detect nginx alias traversal vulnerabilities using heuristic and brute-force techniques for identifying vulnerable…

f4rber/cve-2020-36287

The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from…

unix13/metasploitable2

PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon,…

nahamsec/hostilesubbruteforcer

Subdomain brute-forcing tool that enumerates existing subdomains and detects misconfigured cloud-hosted subdomains vulnerable to takeover across AWS,…