dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

crypto

Go Cryptography This repository holds supplementary Go cryptography packages. Report Issues / Send Patches This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute. The git repository is https://go.googlesource.com/crypto...

droidlysis

DroidLysis DroidLysis is a pre-analysis tool for Android apps : it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. The...

grype

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC

🔓 CVE-2026-3502 - TrueConf Client Update Hijacking Exploit ⚠️ WARNING This tool is for educational purposes and authorized testing only. Do not use on systems without explicit permission. 📋 Description Exploit for CVE-2026-3502 - update vulnerability without integrity verification in TrueConf...

Arcane

Arcane is a simple script designed to backdoor iOS packages iphone-arm and create the necessary resources for APT repositories. It was created for this publication to help illustrate why Cydia repositories can be dangerous and what post-exploitation attacks are possible from a compromised iOS...

vulnerablecode

============== VulnerableCode VulnerableCode is a database of software package vulnerabilities with Web UI and API. Why Use VulnerableCode? VulnerableCode provides a Web UI and API to access a database of known software package vulnerabilities with comprehensive information from upstream and...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

kimi

kimi - Malicious Debian Package generator Script to generate malicious debian packages debain trojans. About & Plus points & Usage & Tested On ::: Kimi is name inspired from "Kimimaro" one of my favriote charater from anime called "Naruto". Kimi is a script which generates Malicious debian packag...

faraday-cli

Faraday on the terminal Use faraday directly from your favorite terminal faraday-cli is the official client that make automating your security workflows, easier. Before installing, we recommend creating and activating a Python virtual environment to avoid affecting your system Python packages. Fo...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...

capslock

Capslock is a capability analysis CLI for Go packages that informs users of which privileged operations a given package can access. This works by classifying the capabilities of Go packages by following transitive calls to privileged standard library operations. The recent increase in supply chai...

advisory-database

Python Packaging Advisory Database This is a community owned repository of advisories for packages published on https://pypi.org. Advisories live in the vulns directory and use a YAML encoding of a simple format. Contributing advisories Making a pull request Existing entries can be edited by simp...

fire-hd-ownership

fire-hd-ownership Owning the tablet I already bought. In November 2022 I bought a Fire HD 10 11th gen, 2021 model on eBay for $114.26 to be a Home Assistant kiosk. It ran fine for years, then started powering itself off. The logs said why: Amazon's own software was issuing the shutdowns, and the...

distro

REMnux Distro Repository This repository contains supplemental files for the REMnux distro and the source files for the Debian packages that the distro installs from the REMnux package repository on Launchpad. Repository Structure files/ Supplemental files used by the REMnux distribution,...

platform_packages_providers_MediaProvider_CVE-2023-40127

This repository does not have a README...

Pip-Intel

🌐PIP-INTEL - OSINT and Cyber Intelligence Tool🌐 Tested: Kali-Linux Pip-Intel is a powerful tool designed for OSINT Open Source Intelligence and cyber intelligence gathering activities. It consolidates various open-source tools into a single user-friendly interface simplifying the data collection...

cisco_asa_research

Cisco ASA Research This repository contains slides and code presented at Black Hat USA 2022 and DEF CON 30. The following can be found: Slides DEF CON 30 and Black Hat slide decks. The DEF CON deck is slightly longer due to a longer time slot. theway - a tool for creating malicious/distributable...

golang-x-text

Go Text This repository holds supplementary Go packages for text processing, many involving Unicode. CLDR Versioning It is important that the Unicode version used in x/text matches the one used by your Go compiler. The x/text repository supports multiple versions of Unicode and will match the...