fuzzer-testing

fuzzer-testing Standardized Docker images for evaluating open-source fuzzers, fully integrated with the corpora for easy experimentation. Supported / Included Fuzzers AFL github.com/google/AFL AFLplusplus github.com/AFLplusplus Honggfuzz github.com/google/honggfuzzz QSYM sslab-gatech/qsym Eclipse...

EuConform

EuConform 🇪🇺 Open-Source Evidence Toolkit For AI Compliance Open evidence format • Local bias evaluation • Schema validation • CycloneDX interoperability Offline-first • Privacy-preserving • Reusable artifacts • WCAG 2.2 AA accessible EuConform defines an open evidence format for AI compliance and...

clusterfuzz

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

CVE-2025-24016

Wazuh Remote Code Execution RCE - PoC Vulnerability Overview This repository demonstrates the remote code execution RCE vulnerability in the Wazuh server, introduced by an unsafe deserialization in the wazuh-manager package. The vulnerability allows remote attackers with API access compromised...

waf-tester

🛡️ WAF Tester Enterprise WAF Evaluation Tool — Real attack payloads. Real results. Compliance-ready reports. WAF Tester evaluates Web Application Firewalls by sending real attack payloads to a user-supplied URL and reporting whether they are blocked. Available as a Windows desktop app Electron and...

TLS-Scanner

TLS-Scanner TLS-Scanner es una herramienta para ayudar a pentesters e investigadores de seguridad en la evaluación de configuraciones de servidores y clientes TLS. Tenga en cuenta: TLS-Scanner es una herramienta de investigación destinada a desarrolladores TLS, pentesters, administradores e...

CVE-2026-1801C

CVE-2026-1801C QUANTUM-SHIFT / CVE-2026-180A7 BAL-JUMP: Static Analysis of Movement Input Heuristics in Source 2 server.dll Abstract This paper presents a static reverse-engineering analysis of two client-side movement verification routines implemented in the Counter-Strike 2 engine server.dll: t...

redteam-ai-benchmark

Red Team AI Benchmark Russian version: README.ru.md Red Team AI Benchmark is a CLI model-evaluation benchmark. It measures how LLMs understand and respond to red-team questions and security scenarios; it is not a tool for carrying out those activities. Version 2 uses a rubric-based dataset instea...

ccs-eval

Evaluates hosts for CVE-2014-0224 vulnerability https://vulners.com/cve/CVE-2014-0224 Usage: ccs-eval.py list-of-hosts.txt -Takes in a list of hosts, line seperated. Checks the host for common SSL ports using nmap. Peforms PoC injection test supplied by RedHat fake-client-early-ccs.pl. Writes...

anamnesis-release

Anamnesis: LLM Exploit Generation Evaluation This repository contains the evaluation framework for studying how LLM agents generate exploits from vulnerability reports in the presence of exploit mitigations. Given a bug report and proof-of-concept trigger, agents analyze vulnerable software and...

CVE-2021-26084

CVE-2021-26084 Introduction This write-up provides an overview of CVE-2021-26084 - Confluence Server Webwork OGNL injection 1 that would allow an authenticated user to execute arbitrary code on a Confluence Server or Data Center instance. TL;DR Confluence Server / Data Center makes use of Webwork...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

giskard-oss

Evals, Red Teaming and Test Generation for Agentic Systems Modular, Lightweight, Dynamic and Async-first...

gate0

gate0 A small, auditable, terminating, deterministic micro-policy engine. Why Gate0? I built Gate0 because I was tired of debugging RegEx-based policies in production. I wanted something that was boring, bounded, and impossible to crash. If you want a flexible, general-purpose policy engine, you...

exploitgym

ExploitGym ExploitGym is a large-scale, realistic benchmark built from real-world vulnerabilities across userspace programs, Google's V8 engine, and the Linux kernel, designed to evaluate AI agents' ability to develop exploits. Quick start root@kitploit: 1. Python deps uv sync --extra proxy 2...

bloom

Bloom: Automated Behavioral Evaluations for LLMs !IMPORTANT Bloom has a new home. It is now developed and maintained by Meridian Labs and lives at meridianlabs-ai.github.io/petribloom — all new features and fixes will land there. This repository is frozen at its last standalone release and will n...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE Exploit Scanner CVE-2025-3248 This Python-based scanner automates the detection of unauthenticated Remote Code Execution RCE vulnerabilities in Langflow instances via CVE-2025-3248. It uses a proof-of-concept payload that abuses the /api/v1/validate/code endpoint to execute...

gotestwaf

GoTestWAF GoTestWAF es una herramienta para la simulación de ataques API y OWASP que admite una amplia gama de protocolos API, incluyendo REST, GraphQL, gRPC, SOAP, XMLRPC y otros. Fue diseñada para evaluar soluciones de seguridad de aplicaciones web, como proxies de seguridad API, cortafuegos de...

CVE-2026-42533

CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...