grap

grap: define and match graph patterns within binaries https://github.com/QuoSecGmbH/grap grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them. Patterns are user-defined graphs with...

pocsuite3

pocsuite3 Legal Disclaimer Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only 法律免责声明 未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 pocsuite3 仅用于安全测试目的 Overview pocsuite3 is an open-sourced remote vulnerability testing and...

DuplicateDump

DuplicateDump DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump...

taowu-cobalt_strike

Taowu A red team automation framework based on the Cobalt Strike platform. For communication and learning only, do not use for illegal purposes! The exploits used in the plugin are collected from the internet. Security issues are not guaranteed. Please conduct your own security review!...

stoq

Get Started Documentation Installation Plugin Repository Plugin Documentation Overview stoQ is an automation framework that helps to simplify the mundane and repetitive tasks an analyst is required to do. It enables analysts and DevSecOps teams to quickly transition between different data sources...

x64dbg

x64dbg An open-source binary debugger for Windows, aimed at malware analysis and reverse engineering of executables you do not have the source code for. There are many features available and a comprehensive plugin system to add your own. You can find more information on the blog! Screenshots |...

EUVD-2026-116486

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

creepy

creepy NOTE This project is currently not maintained. I haven't put any work on it since 2016 and with the current state of the API access to instagram and twitter, and the default settings for their geolocation features cree.py wouldn't be of much use. I will live the repository and site up for...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

KeePwn

A python script to help red teamers discover KeePass instances and extract secrets. Features KeePass Discovery Look for KeePass installation files through SMB C$ share. Accept multiple target sources IP, CIDR, hostname, file. Check for KeePass metadata version, last access time. Check for running...

stavrobot

Stavrobot Stavrobot is a personal AI assistant built with the principle of "all the access an AI assistant needs, and no more". It has all the nice features of an AI assistant, but focuses on sandboxing, isolation, and minimal permissions. It's lightweight and is deployed with only a docker compo...

CVE-2026-121509

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

hal

Welcome to HAL! HAL /hel/ is a comprehensive netlist reverse engineering and manipulation framework. Navigation 1. Introduction 2. Build Instructions 3. Quickstart Guide 4. Academic Context Introduction What the hell is HAL? Virtually all available research on netlist analysis operates on a...

DriverBuddyReloaded

Driver Buddy Reloaded Table of Contents Driver Buddy Reloaded Table of Contents Installation Quick Usage Advanced Usage About Driver Buddy Reloaded Finding DispatchDeviceControl Labelling WDM and WDF Structures Finding and Decoding IOCTL Codes Flagging Functions Finding DeviceName Dumping Pooltag...

CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...

CVE-2026-121509

The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....

xpfarm

XPFarm An open-source AI-augmented offensive security platform that wraps well-known security tools behind a unified web UI — with distributed scanning, AI-generated reports, a smart scan planner, an interactive attack graph, and a community Plugin SDK. Also check out ObsidianBox Modern on Google...

macSubstrate

 macSubstrate - Substrate for macOS macSubstrate is a platform tool for interprocess code injection on macOS, with the similar function to Cydia Substrate on iOS. Using macSubstrate, you can inject your plugins .bundle or .framework into a mac app including sandboxed apps to tweak it in the...

WPintel

Features • Installation • Use • License • Download Video Demonstration Features Detect WordPress version Detect version vulnerabilities Enumerate Users Detect Themes Detect Plugins Find full path disclosure Check user registration status Installation Google chrome users can download WPintel from...

jsdeob-workbench

jsdeob-workbench A visual workbench for deobfuscating JavaScript. Build transform chains, step through them, write your own plugins. YouTube Demo https://www.youtube.com/watch?v=7zuqKoJT2BM https://www.youtube.com/watch?v=bOVnPIfjoco What is this? This application reveals the Abstract Syntax Tree...