vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

medusa

🐍 MEDUSA - AI Security Scanner AI-first security scanner with 40,000+ detection patterns for AI/ML, agents, and LLM applications. 🤖 Works out of the box - no tool installation required. 🚨 200 CVEs: Log4Shell, Spring4Shell, XZ Utils, LangChain RCE, MCP-Remote RCE, React2Shell 🔥medusa scan --git —...

ChameleonMini

ChameleonMini This is NOT the official repository of ChameleonMini, a freely programmable portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags, and sniff/log RF data. This repository brings support for the Chameleon Tiny. Our Project is based on the...

minimal

137 small, hardened container images. Free, MIT-licensed, signed, and rebuilt daily. Browse the catalog → Quick start docker pull ghcr.io/rtvkiz/minimal-python:latest No account needed. Every image has a :latest-dev companion with a shell and toolchain for debugging and multi-stage builds. docker...

CVE-2020-3452

This repository does not have a README...

behave

Behave! A Still in Development monitoring browser extension for pages acting as bad boys. NB : This is the code repository of the project, if you're looking for the packed extensions: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-93749 DESCRIPTION:...

dnsdiag

DNS Measurement, Troubleshooting and Security Auditing Toolset Have you ever wondered if your ISP is intercepting your DNS traffic? Have you noticed any unusual behavior in your DNS responses, or been redirected to the wrong address and suspected something might be off with your DNS? We offer a...

cve-mcp-server

🛡️ CVE MCP Server AI-powered security intelligence at your fingertips — 28 tools + a one-calltriagecve orchestrator, 24 data sources, one protocol. A production-grade Model Context Protocol MCP server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs...

FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after...

ZeusCloud

Secure your cloud. ZeusCloud is an open source cloud security platform. Discover, prioritize, and remediate your risks in the cloud. Build an asset inventory of your AWS accounts. Discover attack paths based on public exposure, IAM, vulnerabilities, and more. Prioritize findings with graphical...

AzureAD-Attack-Defense

Attack and Defense Playbook for Microsoft Entra This publication is a collection of various common attack scenarios on Microsoft Entra and how they can be mitigated or detected. All of the included scenarios, insights and comments are based on experiences from the contributors during their attack...

PMapper

Principal Mapper Principal Mapper PMapper is a script and library for identifying risks in the configuration of AWS Identity and Access Management IAM for an AWS account or an AWS organization. It models the different IAM Users and Roles in an account as a directed graph, which enables checks for...

ntopng

ntopng Introduction ntopng® is a web-based network traffic monitoring application released under GPLv3. It is the new incarnation of the original ntop written in 1998, and now revamped in terms of performance, usability, and features. While you can read more about ntopng on the ntop web site...

frida

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: pip install frida-tools CLI tools pip install frida...

defenselessV1

defenselessV1 Defenseless is a vulnerable web application written in PHP/MySQL. This is the first version of this application. The purpose of this application is to create security awareness among developers and new guys in application security. It would soon be updated with with more bugs and a...

CVE-2022-40146_Exploit_Jar

Apache Batik SSRF to RCE Jar Exploit Component link https://github.com/apache/xmlgraphics-batik Blog https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading Usage Modify the line 11 in...

PESTO

PESTO: PE files Statistical Tool Description PESTO is a Python script that extracts and saves in a database some PE file security characteristics or flags searching for every PE binary in a whole directory, and saving results in a database. It checks for architecture flag in the header, and for t...

PMAT-labs

PMAT-labs 🔬 Welcome to the labs for Practical Malware Analysis & Triage. !Release Versionimg-version-badgerelease !Course Linkcoursecourse-link !EULAimg-license-badgeeula 🔴 WARNING 🔴 Read this carefully before proceeding. This repository contains live malware samples for use in the Practical...