WPScan is a Ruby-based CLI security scanner for WordPress sites. It detects vulnerabilities in WordPress core, plugins, and themes, enumerates users and misconfigurations, and supports password brute-force attacks. The architecture follows a controller/finder pattern: controllers orchestrate scan phases (version detection, enumeration, password attack), and finders implement passive/aggressive detection strategies for specific items (plugins, themes, users, backups, etc.). HTTP client is a singleton wrapping Typhoeus with caching, throttling, and proxy support. Vulnerability data is retrieved from the WPScan API or local enterprise database dumps. The codebase is well-structured with clear separation of concerns, extensive test coverage, and support for multiple output formats (CLI, JSON, SARIF). It is actively maintained and regularly updated to keep pace with WordPress ecosystem changes.
Evil Limiter is a Linux command-line tool that uses ARP spoofing and traffic shaping (tc/iptables) to monitor, analyze, and limit the bandwidth of devices on a local network without requiring administrative access to those devices. It provides an interactive shell with commands to scan for hosts, limit or block bandwidth per host (upload/download), monitor real-time bandwidth usage, and detect host IP changes. The architecture is a single-threaded interactive menu with background threads for ARP spoofing, bandwidth monitoring, and reconnection watching. It depends on scapy for packet manipulation, netifaces for network interface info, and standard Linux utilities (tc, iptables, sysctl). The codebase is well-organized into modules for console UI, networking operations, and command parsing, but lacks tests and has limited reusability outside its specific purpose.
This repository contains a monolithic Python 2 CLI application for brute-force cracking of Facebook accounts. It provides a menu-driven interface that allows a user to log in with a Facebook access token or credentials, then attempt to crack the passwords of friends or specified user IDs using a hardcoded set of common passwords (e.g., '786786', 'Pakistan', first_name+786). The tool also includes features for extracting friend IDs, emails, and phone numbers via the Facebook Graph API, as well as automating post deletion, friend request acceptance, and unfriending. The architecture is tightly coupled, with global variables, repetitive code, and no separation of concerns. The main entry point is `wasi.py`, which calls `tlogin()` for authentication and then delegates to `.wasii.py` for the main menu and cracking logic. A secondary module `.opt.py` offers a variant with user-specified password lists. The code relies on deprecated Python 2 libraries (mechanize, urllib) and hardcoded Facebook API tokens, making it fragile and insecure. There are no tests, no modular design, and the code exhibits poor craftsmanship with minimal error handling and no reusability. The repository is a typical example of a low-quality hacking script popular in underground communities, with high technical drift due to Python 2 deprecation and likely outdated API endpoints.