msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

llm-council-vapt

LLM Council — VAPT Finding Validation A blind peer-review pipeline that validates a penetration-test finding before it reaches a client. Independent expert lenses assess the finding, blind-review each other, and a Chairman synthesizes one vetted verdict — is it worth reporting, and is the severit...

fastfinder

FastFinder A lightweight incident response tool for threat hunting and forensic triage ✨ Overview FastFinder is a powerful, lightweight incident response tool designed for cybersecurity professionals conducting threat hunting, live forensics, and endpoint triage. Built for both Windows and Linux...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

dorkscout

dorkscout dokrscout is a tool to automate the finding of vulnerable applications or secret files around the internet throught google searches, dorkscout first starts by fetching the dorks lists from https://www.exploit-db.com/google-hacking-database and then it scans a given target or everything ...

xnLinkFinder

About - v8.2 This is a tool used to discover endpoints, discover potential parameters, generate a target specific wordlist and find secrets for a given target. It can find them by: crawling a target pass a domain/URL crawling multiple targets pass a file of domains/URLs searching files in a given...

Aurora-Incident-Response

Aurora Incident Response Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders. Aurora brings "Spreadsheet of Doom" used in the SANS FOR508 class to the next level. Having led many cases and taught so many students how to do IR right, I realized, that...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install GO111MODULE=on go install github.com/jaeles-project/gospider@latest Docker...

ConcoLLMic

ConcoLLMic: Agentic Concolic Execution Paper : IEEE S&P 2026 ConcoLLMic is the first language- and theory-agnostic concolic executor powered by LLM agents. Unlike traditional symbolic execution tools that require language-specific implementations and struggle with constraint solving, ConcoLLMic:...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To search for keys i...

multiplier

Multiplier finds more bugs faster Multiplier provides precise and comprehensive code understanding capabilities. It does so by saving build artifacts into a database, and then making them persistently accessible using a C++ or Python API. Multiplier emphasizes the ability to uniquely identify all...

kingfisher

Detect and Validate Secrets Anywhere. Map Access. Revoke Fast. Find leaked secrets. Validate what’s live. Map the blast radius. Revoke fast. Kingfisher is a fast, free, open-source secret scanner and credential response tool built in Rust. It detects leaked secrets with hundreds of built-in rules...

ssh-mitm

SSH MITM v2.3-dev Author: Joe Testa @therealjoetesta Overview This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...

Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Posted by Samuel Groß Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep...

litefuzz

litefuzz Un fuzzer multiplataforma para probar binarios en espacio de usuario, clientes y servidores. Ha encontrado errores en más de 50 aplicaciones y bibliotecas de empresas importantes y código abierto. Configuración simple para comenzar a fuzzear en Linux, Mac y Windows. litefuzz intro why ho...

lava

LAVA: Adición Automatizada de Vulnerabilidades a Gran Escala Evaluar y mejorar las herramientas de búsqueda de errores es actualmente difícil debido a la escasez de corpus de verdad fundamental es decir, software que tiene errores conocidos con entradas que los desencadenan. LAVA intenta resolver...

Contextualization of Third-Party Cloud Security Findings

Finding severity is the main driver of how security teams prioritize remediation. For third-party cloud security findings, that severity is static: the rule that raised the finding assigns it before the rule meets any environment, so it reflects the risk of the condition in general rather than th...