swarm

swarm v0.6.0 English | 中文. Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

postenum

Postenum makes life easier for security professionals by automating the process of gathering critical system information after gaining a foothold. It helps quickly spot misconfigurations and privilege escalation opportunities, streamlining the path to deeper access. Built to be lightweight,...

kubernetes-goat

Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster...

ws4-secure-design-agentic-systems

CoSAI Workstream 4: Secure Design Patterns for Agentic Systems This repository is for the work of the CoSAI Workstream 4, Secure Design Patterns for Agentic Systems. CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry leading organizations dedicated to...

terragoat

TerraGoat - Vulnerable Terraform Infrastructure TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find the...

GCPGoat

GCPGoat : A Damn Vulnerable GCP Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since...

burner-net

BurnerNet Zero-trust, anti-forensic HTTP client. Wipes secrets. Severs traces. CPR in a Stealth Tank. 👻 BurnerNet is a C++20 anti-forensic HTTP client. It provides a fluent, CPR-like API for apps that cannot fully trust the local machine—physically wiping secrets from RAM and severing execution...

CVE-2024-50482

CVE-2024-50482 Woocommerce Product Design = 1.0.0 - Unauthenticated Arbitrary File Upload Description: The Woocommerce Product Design plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.0. This makes it possibl...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

trust-my-agent-ai

🛡️ TrustMyAgent Security bodyguard for OpenClaw agents Website • Trust Center • Quick Start • Contributing An EDR-like security agent for OpenClaw agents. Runs 41 security checks across 14 domains, calculates a trust score 0-100, and sends telemetry to a centralized Trust Center dashboard where...

PersistAssist

PersistAssist PersistAssist is a fully modular persistence framework written in C. All persistence techniques contain a cleanup method which will server to remove the persistence aside from the persistence code. This is a WIP so there are many empty classes, the main object of this project...

CVE-2020-0096-StrandHogg2

This design flaw allows an attacker to display their own activity page on top of another application, potentially causing users to lose track of their private data. This vulnerability is called StrandHogg 2.0 and was recently disclosed by the Norwegian security company Promon. Scope: Theoreticall...

logira

logira OS-level runtime auditing for unpredictable automation. logira is an observe-only Linux CLI that records runtime exec, file, and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-ru...

cve_2022_0492

Shell Script Template A modern Bash script template with colorized output formatting and utility functions for creating professional command-line tools. Features 🎨 Colorized Output : Pre-defined color schemes and formatting functions 📝 Standardized Messages : Consistent info, success, warning, an...

TerraformGoat

TerraformGoat English | 中文 TerraformGoat is HXSecurity research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. 🎯 Scenarios ID| Cloud Servic...

Hale

About Hale is a botnet command & control monitor/spy with a modular design to easily develop new modules that monitor new protocols used by C&C servers. Hale comes with IRC and HTTP monitors developed with Twisted to handle scalability of a large amount of connections. Theses modules have...

tech-seminar-React2Shell

React2Shell CVE-2025-55182 Woori FISA Technical Seminar 6th - Team 3: Analysis and research on React2Shell, a remote code execution RCE vulnerability exploiting design flaws in React Server Component RSC Team Member| Role| GitHub ---|---|--- 남인서| Research, PPT production, Presentation| @sene03 유승...

AzureGoat

AzureGoat : A Damn Vulnerable Azure Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure...

CVE-2025-49844_POC

CVE-2025-49844POC CVE-2025-49844 POC -h View help information ··· Redis has a Redis Lua script remote code execution vulnerability CVE-2025-49844. The root cause of this vulnerability is a design flaw in the interaction between Redis's Lua script engine and its memory management logic. ··· ···...