Awesome Web Security

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

UNIX-like reverse engineering framework and command-line toolset

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

The Browser Exploitation Framework Project

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Chrome extension and Express server that exploits keylogging abilities of CSS.

🔥Open source RASP solution

HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors

Find web directories without bruteforce

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

The AI Agent for Cyber Security.

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Content released at NorthSec 2018 for my talk on prototype pollution

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Offline-first, searchable arsenal for pentesting & bug bounty: payloads, a click-to-build command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells, checklists & an engagement tracker.

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

vulnerable web application for training

Security training for the apps you actually ship. Open your browser and start hacking.

🔌 OSINT & Security Extensions for Marshall Browser - Installable plugins for enhanced reconnaissance and security testing

Privacy-first Chrome extension for real-time website security analysis using on-device AI. Trust scores (0-100), phishing detection, SSL verification, cookie compliance & AI chatbot powered by WebLLM with zero external data transmission.

Is this app legit? Check before you connect. Free URL security scanner for indie developers and AI builders. Live at trustscanpro.com