undetected-httpx

undetected-httpx 2.0 undetected-httpx is an HTTP probing toolkit built on ProjectDiscovery's httpx, with browser TLS and HTTP/2 fingerprints powered by HTTPCloak. Version 2.0 replaces the Python wrapper with a Go fork of httpx v1.12.0. You get the upstream probes, flags and output formats, with...

ChromeAlone

ChromeAlone - A Browser C2 Framework What does this get me? ChromeAlone is a browser implant that can be used in place of conventional implants like Cobalt Strike or Meterpreter. This repo provides a simple build process that will generate a management console, deploy infrastructure, and create a...

LLMReaper

Passive LLM Conversation Capture & Sensitive Data Exposure Research Chromium MV3 Extension • Real-Time DOM Capture • Secret Detection • FastAPI Backend !WARNING This project is provided strictly for security research, educational use, and defensive awareness purposes. Unauthorized deployment...

crlf-desyncs

CRLF Desyncs This is a repository containing useful tools and resources for detecting and exploiting CRLF-based Desyncs, presented at BlackHat USA 2026 and DEFCON 34. Contents cdn-origin/ - contains aggregated origin-to-edge headers useful for fuzzing a CRLF injection on a response...

datadome-vm-internals

DataDome VM DataDome embeds a custom VM in their bundle to hide what they're actually doing. I got curious and pulled it apart. Sharing it here for anyone who's interested in the same kind of reverse engineering puzzle. DataDome ships a heavily obfuscated JavaScript bundle to your browser. Inside...

bramble

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

HackBrowserData

HackBrowserData HackBrowserData is a command-line tool for decrypting and exporting browser data passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions from the browser. It supports the most popular Chromium-based browsers and Firefox o...

libretto

Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

phishcollector

PhishCollector PhishCollector is a research framework for collecting, analysing, and tracking phishing sites. It is intentionally designed as a starting point — the detection rules, technology signatures, wordlists, and plugins are all plain data structures that researchers are expected to read,...

DotGit

DotGit An extension for checking if .git is exposed in visited websites Features Check if a .git/.svn/.hg folder exists for each site you visit Check if a .env file exists for each site you visit Check if a .DSStore file exists for each site you visit Check if the site is open source github/gitla...

CVE-2019-0567-MS-Edge

CVE-2019-0567-MS-Edge POC A Proof a concept for MS Edge in as an exercise to learn browser exploiting and migrations that are presented on the Windows 10 machine. All code were created by Connor McGarr and edited to work on Windows 10 build 15063.483. shell2js.py My personal script to convert...

HackTools

Welcome to HackTools ! Introduction — Preview — Install — Build — Support !NOTE Psst... Loved HackTools? 👀 Check out Penflow - our new security testing companion! Try it at map.penflow.sh 🚀 !NOTE Dear Users, We're excited to announce a major revamp of our app! Due to recent changes and multiple...

netmap.js

netmap.js Fast browser-based network discovery module This project is no longer maintained. Description netmap.js provides browser-based host discovery and port scanning capabilities to allow you to map website visitors' networks. It's quite fast, making use of es6-promise-pool to efficiently run...

IronFox

IronFox F-Droid QR Code: IronFox is a fork of Divested Computing Group's Mull Browsermull, based on Mozilla Firefox. Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use. !TIP Find a bug? Encounter an annoying...

waf-fu

waf-fu AWS WAF v2 log browser and replayer with an interactive TUI. Pulls logs from CloudWatch, S3, and the WAF sampling API with SQLite caching, displays them in a split-pane terminal UI with auth detection and YAML-based filtering, and replays requests through Firefox, Chrome, or curl with full...

on-device-browser-agent

Local Browser - On-Device AI Web Automation Launching support for runanywhere-web-sdk soon in our main repo: please go check it out: https://github.com/RunanywhereAI/runanywhere-sdks A Chrome extension that uses WebLLM to run AI-powered web automation entirely on-device. No cloud APIs, no API key...

BFuzz

BFuzz BFuzz is currently in beta. BFuzz is an input based fuzzer tool which take .html as an input, open's up your browser with a new instance and pass multiple testcases generated by domato which is present in recurve folder of BFuzz, more over BFuzz is an automation which performs same task...

CVE-2026-100380

CVE-2026-100380: Reflected XSS in language-validation errors Reporter: Marco Paciaroni BomboBombone. Wikibase included unescaped language-validation error text in the SetLabel page. Rejected input could be returned as executable HTML before the request reached the label-saving operation. Affected...

piraterf

🏴‍☠️ PIrateRF - Software-Defined Radio Transmission Platform PIrateRF transforms your Raspberry Pi Zero W into a portable RF signal generator that spawns its own WiFi hotspot. Control everything from FM broadcasts to digital modes through your browser - hack the airwaves from anywhere! 📡⚡ 🎬 Click...