Search awesome repositories

Rip web accessible (distributed) version control systems: SVN/GIT/HG...

DOM fuzzer

Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

Interactive CTF Exploration Tool

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

This project has been moved to:

A DNS rebinding attack framework.

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

Some public notes

A collection of AWS penetration testing junk

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Scriptable local traffic workbench for inspecting, intercepting, replaying, and rewriting HTTP/HTTPS and WebSocket traffic.

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

SpiderSuite (web security crawler) releases, wiki and roadmap

Auditing for TLS certificates.

The AI Agent for Cyber Security.

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin.

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

🔪Browser logic vulnerabilities :skull_and_crossbones:

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

List DTDs and generate XXE payloads using those local DTDs.

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

🔐 Tutorial of setting up Security for your API with one way authentication with TLS/SSL and mutual authentication for a java based web server and a client with both Spring Boot. Different clients are provided such as Apache HttpClient, OkHttp, Spring RestTemplate, Spring WebFlux WebClient Jetty and Netty, the old and the new JDK HttpClient, the old and the new Jersey Client, Google HttpClient, Unirest, Retrofit, Feign, Methanol, vertx, Scala client Finagle, Featherbed, Dispatch Reboot, AsyncHttpClient, Sttp, Akka, Requests Scala, Http4s Blaze, Kotlin client Fuel, http4k, Kohttp and ktor. Also other server examples are available such as jersey with grizzly. Also gRPC, WebSocket and ElasticSearch examples are included

Auto Scanning to SSL Vulnerability

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Content released at NorthSec 2018 for my talk on prototype pollution

JShell - Get a JavaScript shell with XSS.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js