Tools

j-baines/even-you-brutus

Dictionary Brute Force of the Mikrotik RouterOS 6.x Web Interface

ajnik/joomla-bruteforce

Python script that brute-forces Joomla administrator login credentials using wordlists, with proxy and verbose options for penetration testing.

golem445/corporate_masks

8-14 character Hashcat masks based on analysis of 3.2 million NTLM hashes cracked while pentesting

star-sg/random-scripts

Collection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…

jorianwoltjer/shodan-favicon-preimage

Generate a favicon that results in any target hash on Shodan

rub-syssec/omen

Markov model-based password guesser in C that enumerates candidates by probability, generating most likely passwords first for hash cracking via…

nu11secur1ty/kousei

Python/Go framework that generates SQL injection PoC requests, automates sqlmap attacks, and manages modular exploit scripts with parameter detection…

qsecure-labs/deadmatter

Offset Independent Credential Extraction Tool

grepstrength/cve-2026-92680

Proof-of-concept decrypting Araxis Merge's DPAPI-protected server credentials (CVE-2026-92680), demonstrating insufficiently protected credential…

4nner/cve-2019-9053

Python 3 exploit for CVE-2019-9053, a CMS Made Simple SQL injection vulnerability, enabling credential extraction via time-based blind SQLi and…

pervinzahidli/cve-2026-77771

Advisory for CVE-2026-77771, a 2FA bypass in the miniOrange WordPress plugin via session-scoped OTP lockout, with impact analysis and remediation…

zhairiazzeddine/exploit-cve-2023-6063-poc-vuln

Python PoC for CVE-2023-6063, an unauthenticated time-based blind SQL injection in WP Fastest Cache <=1.2.2, extracting WordPress password hashes and…

mycode83/godirb

Fast and easy-to-use directory brute-forcer written in Go.

sadreck/crackerjack

Web-based GUI for Hashcat that simplifies password cracking with session management, mask generation, wordlist support, and multi-user access.

n0isegat3/regpwnbrc4bof

Brute Ratel C4 BOF that exploits a registry symlink race condition in Windows Accessibility ATConfig to escalate privileges to SYSTEM by writing…

dhammon/hoteldruid-cve-2021-42949

Exploit for CVE-2021-42949 in HotelDruid v3.0.3, demonstrating predictable session token generation and authentication bypass via brute force.

boreas37/cve-2026-43914-poc

PoC for CVE-2026-43914: Vaultwarden <1.35.4 email-2FA brute-force bypass password oracle. Stdlib-only Python.