#1Strumenti per testare e implementare meccanismi di autenticazione (es. MFA, SSO) e politiche di autorizzazione.
Raccomandato da Kitploit
abraxas/opnsense-captive-lastseen-roamOPNsense 26.7.6 - High - Remote - Network-access bypass - captive lastseen roam
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
abraxas/bitwarden-cipher-create-aclBitwarden Server v2026.9.2 - High - IDOR - plant decryptable vault items into collections the caller cannot write
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
abraxas/hyperswitch-payout-confirm-secretProof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
abraxas/nextcloud-ldap-put-isadminNextcloud 35.0.0 — delegated Users admin can PUT-edit an LDAP-promoted admin that PATCH correctly refuses
abraxas/nextcloud-webhook-tokenneededNextcloud 35.0.0 — delegated Webhooks admin can mint a 1h admin app password via webhook update tokenNeeded
abraxas/mysql-set-role-leftoverMySQL Community Server 26.7.0 - High - SET ROLE ALL EXCEPT leftover FILE - mysqld UID write
abraxas/sqlite-fj-using-authSQLite 3.53.4 - High - Local - Privilege leftover - FULL JOIN USING skips sqlite3AuthRead
abraxas/forgejo-keys-idorForgejo 16.0.5 - High - Remote - IDOR - GET /api/v1/user/keys/{id} returns other users SSH and deploy keys
abraxas/grafana-signup-invite-joinGrafana OSS 13.2.3 - High - Remote - Invite join - SignUpStep2 joins pending org invites without the code
abraxas/joomla-levels-apiJoomla 6.1.3 - High - Remote - ACL - GET /api/v1/users/levels leaks view levels
abraxas/joomla-articles-catidJoomla 6.1.3 - High - Remote - ACL - POST /api/v1/content/articles ignores per-category ACL
abraxas/joomla-menu-items-apiJoomla 6.1.3 - High - Remote - ACL - menu items API leftover
abraxas/proftpd-sftp-copy-file-writeProFTPD 1.3.9d - High - Remote - Privilege leftover / File write - SFTP copy-file skips dest WRITE
cyrusimap/cyrus-saslImplementazione dell'API Cyrus SASL che fornisce servizi di autenticazione e autorizzazione lato client e lato server tramite meccanismi SASL…
