Search awesome repositories

Nano is a family of PHP web shells which are code golfed for stealth.

:hammer: Manage your website via terminal

Pillage web accessible GIT, HG and BZR repositories

Stealing CSRF tokens with CSS injection (without iFrames)

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

A free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.

:hammer: A multiple reverse shell session/client manager via terminal

Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.

WebAppSec Content Security Policy

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Minimal code to connect to a CEF debugger.

Offline-first, searchable arsenal for pentesting & bug bounty: payloads, a click-to-build command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells, checklists & an engagement tracker.

A domain searcher named GoogleSSLdomainFinder - 基于谷歌SSL透明证书的子域名查询工具

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

Parse NTLM challenge messages over HTTP and SMB

A simple tool to convert the IP to a DWORD IP

Git manager for pentesters

A whole bunch of public pentest reports & papers

Vulnerable Web applications Generator

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

vulnerable web application for training

A XSS mind map ;)

Security training for the apps you actually ship. Open your browser and start hacking.

documentation and writing

No description.

A script that inspects multi-byte character sets looking for characters with specific user-defined properties

Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).

🔌 OSINT & Security Extensions for Marshall Browser - Installable plugins for enhanced reconnaissance and security testing

Privacy-first Chrome extension for real-time website security analysis using on-device AI. Trust scores (0-100), phishing detection, SSL verification, cookie compliance & AI chatbot powered by WebLLM with zero external data transmission.

Is this app legit? Check before you connect. Free URL security scanner for indie developers and AI builders. Live at trustscanpro.com