teleport

Teleport provides connectivity, authentication, access controls and audit for infrastructure. You might use Teleport to: Set up single sign-on SSO for all of your cloud and on-prem infrastructure. Protect access to servers, Kubernetes clusters, databases, Windows desktops, web applications, and...

carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

LTESniffer

LTESniffer - An Open-source LTE Downlink/Uplink Eavesdropper LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper It first decodes the Physical Downlink Control Channel PDCCH to obtain the Downlink Control Informations DCIs and Radio Network Temporary Identifiers RNTIs of all active user...

purple-team-exercise-framework

Purple Team Exercise Framework PTEF The Purple Team Exercise Framework PTEF is the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence CTI, Red Teams, and Blue Teams. Purple Team Exercises are an efficient method...

awesome-entra

Awesome Entra A curated list of awesome Microsoft Entra tools, guides, and other resources. Contents Merill's newsletter & podcast Mind Map Learning Hubs Presentations aka.ms Tools Community YouTube Podcast Bluesky Twitter LinkedIn Blogs Merill's newsletter & podcast Entra.News - Weekly round up...

EntraGoat

EntraGoat - A Deliberately Vulnerable Entra ID Environment EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe,...

conjur

Conjur Maintainability Test Coverage Conjur provides secrets management and application identity for modern infrastructure: Machine Authorization Markup Language "MAML" , a role-based access policy language to define system components & their roles, privileges and metadata A REST web service to:...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file | manual -i IP,...

IAM Proxy Component Compromise Information Disclosure

The vulnerability of the IAM Proxy component of the Identity & Access Management tool in Platform V IAM is related to synchronization errors when using a common resource. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

Blitz Identity Provider (Authentication server)

...

TokenTacticsV2

/ / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku. Azure JSON Web...

keycloak

Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...

COVIDSafe-CVE-2020-12856

COVIDSafe-CVE-2020-12856: A silent pairing issue in bluetooth-based contact tracing apps Authors: Jim Mussared George Robotics, Alwen Tiu The Australian National University A vulnerability has been identified in the implementation of the Android version of Australia's COVIDSafe v1.0.17 and earlie...

zitadel

The Identity Infrastructure for Developers ZITADEL...

trappsec

trappsec trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into...

AzureAD-Attack-Defense

Attack and Defense Playbook for Microsoft Entra This publication is a collection of various common attack scenarios on Microsoft Entra and how they can be mitigated or detected. All of the included scenarios, insights and comments are based on experiences from the contributors during their attack...

browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

VMWare_CVE-2022-22954

VMWareCVE-2022-22954 CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager Shodan Search result PoC Follow Youtube Twitter Telegram LinkedIn...

dex

dex - A federated OpenID Connect provider Dex is an identity service that uses OpenID Connectopenid-connect to drive authentication for other apps. Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or...

CVE-2026-54121-PoC-Exploit

CVE-2026-54121 - AD CS "Certighost" Elevation of Privilege Framework-Toolkit Active Directory Certificate Services — Certighost → Domain Takeover Exploit Framework & Audit Toolkit For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for educational and...