thc-hydra | ffuf | |
---|---|---|
18 | 17 | |
9,098 | 11,540 | |
- | 2.4% | |
5.6 | 5.7 | |
15 days ago | about 2 months ago | |
C | Go | |
GNU Affero General Public License v3.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
thc-hydra
-
Show HN: Hydra - Open-Source Columnar Postgres
Nice tool, only unfortunate name, consider changing it. Already very well know security tool named hydra https://github.com/vanhauser-thc/thc-hydra been around since 2001. Then facebook went ahead and named their config tool hydra https://github.com/facebookresearch/hydra on top of it. Like we get it, hydra popular mythology but we could use more original naming for tools
- Help with a brute force tool
-
What's everyone working on this week (26/2023)?
I just started learning Rust, but I will begin building a brute-force tool. Hydra is great but lacks updates, IMHO. I started using Golang, but it sucks (I love the Go language, but it sucks for this type of task).
-
The 36 tools that SaaS can use to keep their product and data safe from criminal hackers (manual research)
Hydra
- Unable to complete libssh2 handshake
-
Password Attacks - Network Services
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-01-28 16:31:17 [WARNING] the rdp module is experimental. Please test, report - and if possible, fix. [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 3 tasks per 1 server, overall 3 tasks, 21112 login tries (l:104/p:203), ~7038 tries per task [DATA] attacking rdp://10.129.202.136:3389/ [STATUS] 166.00 tries/min, 166 tries in 00:01h, 20946 to do in 02:07h, 3 active [STATUS] 121.67 tries/min, 365 tries in 00:03h, 20747 to do in 02:51h, 3 active [3389][rdp] account on 10.129.202.136 might be valid but account not active for remote desktop: login: password: , continuing attacking the account. [STATUS] 86.29 tries/min, 604 tries in 00:07h, 20509 to do in 03:58h, 2 active [ERROR] all children were disabled due too many connection errors 0 of 1 target completed, 0 valid password found [INFO] Writing restore file because 2 server scans could not be completed [ERROR] 1 target was disabled because of too many errors [ERROR] 1 targets did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-01-28 16:38:23
- Could use some help
- Github hydra scripts
-
THC-Hydra in Rust FOSS Project
I am searching for people interested in coding an alternative to the thc-hydra project, with additional features (implementing the Shodan api to make it automated, etc...)
-
THM HackPark
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-10-22 13:09:13
ffuf
-
Show HN: Pfuzz, a web fuzzer following the Unix philosophy
It seems to me like "fuzzing" has a different meaning in web application penetration testing. Here, "fuzzer" is a term for tools that just generate different request using wordlists, without adding any mutations. For example, the two popular web fuzzers ffuf [1] and wfuzz [2] also call themselves fuzzers.
I see how reusing a term for a different concept is bothersome, but I feel like "fuzzer" is the term that people learning about bug bounty hunting are familiar with.
[1] https://github.com/ffuf/ffuf
[2] https://wfuzz.readthedocs.io/en/latest/
- Fast web fuzzer written in Go
-
The 36 tools that SaaS can use to keep their product and data safe from criminal hackers (manual research)
FFUF
-
Directory Discovery Tools
I've been using ffuf happily for the past couple of years however I remember seeing a post on reddit/twitter about a new "intelligent" discovery tool.
-
Pentesting Tools I Use Everyday
Learn more about ffuf here: https://github.com/ffuf/ffuf
-
Tips on enumerating unknown APIs in my environment?
Also, I see you mentioned using curl. You can checkout ffuf which is closely related but more geared towards what you're doing.
- Fastest webpath scanner out here?
-
Posodobitev orodja ffuf
git clone https://github.com/ffuf/ffuf ; cd ffuf ; go get ; go build
- ffuf - Fuzz Faster U Fool
-
Brute forcing a website link
So ffuf (https://github.com/ffuf/ffuf) or wfuzz (https://github.com/xmendez/wfuzz) are a better choice to enumerate GET/POST parameters/values.
What are some alternatives?
naive-hashcat - Crack password hashes without the fuss :cat2:
gobuster - Directory/File, DNS and VHost busting tool written in Go
Metasploit - Metasploit Framework
feroxbuster - A fast, simple, recursive content discovery tool written in Rust.
SQLMap - Automatic SQL injection and database takeover tool
nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL.
elpscrk - An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
go-sql-driver/mysql - Go MySQL Driver is a MySQL driver for Go's (golang) database/sql package
mimikatz - A little tool to play with Windows security
go - The Go programming language
PSKracker - An all-in-one WPA/WPS toolkit
ksubdomain - 无状态子域名爆破工具