idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

machinae

Machinae Security Intelligence Collector Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater, another excellent tool...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

popeye

Popeye: Kubernetes 实时集群检查工具 Popeye 是一款实用工具，用于扫描实时 Kubernetes 集群，并报告已部署资源和配置中存在的潜在问题。 随着 Kubernetes 生态系统的增长，人类要跟踪编排集群的大量清单和策略变得越来越困难。 Popeye 基于集群中实际部署的内容进行扫描，而非磁盘上的文件。通过对集群进行代码审查，它能够检测配置错误、过时的资源，并帮助您确保遵循最佳实践，从而预防未来的问题。 它旨在减轻操作 Kubernetes 集群时面临的认知超载。 此外，如果您的集群使用了...

kodex

Kodex Community Edition - CE is an open-source toolkit for privacy and security engineering. It helps you to automate data security and data protection measures in your data engineering workflows. It offers the following functionality: Read data items from a variety of sources such as files,...

droidlysis

DroidLysis DroidLysis is a pre-analysis tool for Android apps : it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. The...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

quien

quien A better whois and domain intelligence toolkit. Interactive TUI with tabbed views for WHOIS, DNS, mail, SSL/TLS, HTTP headers, SEO analysis, and tech stack detection. Try it without installing: ssh quien.sh Install Homebrew root@kitploit: brew install quien Ubuntu / Debian root@kitploit: cu...

nimbostratus-target

Nimbostratus target Este repositorio contiene una infraestructura objetivo que puedes usar para probar nimbostratus. Este código despliega una infraestructura de Amazon AWS que tiene varias vulnerabilidades y configuraciones débiles que pueden explotarse usando nimbostratus. Si no estás seguro de...

cve-2025-32462

cve-2025-32462 sudo/NEWS at SUDO188 · sudo-project/sudo · GitHub The sudo -h --host documentation states that -h can only be used with -l. In later updates, sudo -h was allowed to be used with -e, -i, etc. sudo --host-h -l--list /etc/sudoer.d is used to check what permissions a user has on a...

nomore403

NoMore403 nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses. The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control...

sandmap

sandmap Description • How To Use • Command Line • Configuration • Requirements • Other • Contributing • License • Wiki Description sandmap is a tool supporting network and system reconnaissance using the massive Nmap engine. It provides a user-friendly interface, automates and speeds up scanning...

OFFAT

OWASP OFFAT OWASP OFFAT OFFensive Api Tester is created to automatically test API for common vulnerabilities after generating tests from openapi specification file. It provides feature to automatically fuzz inputs and use user provided inputs during tests specified via YAML config file. Demo Note...

audit

audit Panel de preferencias de Auditoría y lector de registros para OS X OS X tiene un sistema de auditoría integrado basado en OpenBSM. Se configura a través de la línea de comandos y tiene una sintaxis algo esotérica. Para solucionar esto, creé un panel de preferencias del sistema para configur...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mezcla datos de plantilla pura con opciones de configuración del motor a través de la API de renderizado de Express. Al sobrescribir opciones de configuración interna, se puede desencadenar ejecución remota de código en aplicaciones posteriores. Fuente...

LWHP

LWHP Linux and Windows Hardening Points Hardening guides can never be complete as every system needs a different configuration. Consideration it when using these documents and take the points written in this repository as guidelines...

gixy

GIXY Resumen Gixy es una herramienta para analizar la configuración de Nginx. El objetivo principal de Gixy es prevenir configuraciones de seguridad incorrectas y automatizar la detección de fallos. Actualmente, las versiones de Python compatibles son 2.7, 3.5, 3.6 y 3.7. Aviso: Gixy ha sido...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

heimdall_webserver

ATTENTION, this project is on a beta version, there's a lot of bugs and problem, if you want to help the project use this on a lab not in yout real environment. NO, there's not https implemented yet, it will come on the next upgrade Heimdall It's a tool to manage vulnerables packages in your nix...