AI Agent Skills

Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) rese…

KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.

:key: stateless open source password manager

Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!

A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.

A Deep Learning Approach for Password Guessing (https://arxiv.org/abs/1709.00440)

Keeper Secrets Manager is a cloud-based, zero-knowledge platform for securing infrastructure secrets. Provides automatic password rotation and integration into popular D…

🔒command line tool checking password safety🔒

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.

Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authent…

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

Use when you need state across calls — building env vars, navigating with cd, driving REPLs (python -i, mysql, psql, node), or responding to interactive prompts (sudo pa…

Read, write, merge, split, rotate, watermark, encrypt, and OCR PDF files using Python (pypdf, pdfplumber, reportlab, pypdfium2) and command-line tools (poppler-utils, qp…

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token,…

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via…