psudohash

psudohash Cool New Features of v1.1.0 Special thanks to DavidAngelos: ▶️ Added a progress bar in every step to track execution. ▶️ Added options: In-order joins -i / --inorder: join keywords only in the original order e.g. foo,bar,baz → foo, bar, baz, foobar, foobaz, barbaz, foobarbaz. All-order...

Leaked-Credentials

To search for leaked credentials using Google Chrome's Developer Tools and regex, follow these short steps: 1. Open DevTools: In Chrome, navigate to the site you're inspecting, then open Developer Tools with Ctrl+Shift+I Windows/Linux or Cmd+Option+I macOS. 2. Go to Network Tab: Click on the...

detect-ransomware-filenames

Detect Ransomware Filenames This package/script watches SMB transactions to look for known bad filenames that ransomware is known to use. It rides on top of the Anti-Ransomware File System Resource Manager Lists maintained here. How to use A Python script download-list.py is included to be able t...

apkleaks

APKLeaks Scanning APK file for URIs, endpoints & secrets. Installation from Pypi from Source from Docker Usage Options Output Pattern Arguments for disassembler License Acknowledments Installation It's fairly simple to install APKLeaks : from PyPi $ pip3 install apkleaks from Source Clone...

mobsfscan

mobsfscan mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher...

endext

EndExt EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look fo...

electronegativity

Electronegativity ⚠️ This project has been archived ⚠️ Use ElectroNG instead! What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations,...

netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

waf-community-bypasses

WAF community bypasses Web Application Firewalls a.k.a. WAF are garbage. All the vendors, from the cheapest Cloudflare to "enterpise" like Imperva, Akamai, F5, Checkpoint, or Fortinet are just cheating with their customers by delivering 0 actual protection. 99.9% of WAF signatures are just RegExp...

OSCP Notes and Custom Dashboard

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

VibeSec-Skill

VibeSec-Skill Stop vibe coding vulnerabilities into production. An AI skill that brings 5+ years of bug bounty hunting experience directly into your AI coding workflow - so LLM models write secure code from the start. Introduction Vibe coding is fun until your app ends up on social media for all...

third-thoughts

Third Thoughts A Lightless Labs research project studying AI agent behavior at scale through multi-disciplinary corpus analysis basically, throwing stuff at the wall and seeing what sticks. Named after Tiffany Aching's concept from Discworld: first thoughts agents thinking, second thoughts agents...

ws4-secure-design-agentic-systems

CoSAI Workstream 4: Secure Design Patterns for Agentic Systems This repository is for the work of the CoSAI Workstream 4, Secure Design Patterns for Agentic Systems. CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry leading organizations dedicated to...

move-vulnerability-database

Welcome to the Move Vulnerability Database MVD v3.0! A comprehensive collection of vulnerability patterns in the Move ecosystem. What's Inside Vulnerability Patterns - Categorized security issues with examples and severity ratings Appendix - Audit reports and protocol references Learning...

s3dns

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

React2Shell-CVE-2025-55182

$$\ $$\ $$$$$$$\ $$\ $$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$$$$\ $$$\ $$$ |$$ $$\ $$$\ $$$ |$$ |$$ | $\ $$ |$$ $$\ $$ | $$$$\ $$$$ |$$ | $$ | $$$$\ $$$$ | $$ | $$ |$$$\ $$ |$$ / $$ | $$ | $$$$$$ $$ |$$$$$$$ | $$$$$$ $$ | $$ | $$ $$ $$$$ |$$ | $$ | $$ | $$ $$$ $$ |$$ $$ $$ $$$ $$ | $$ | $$$$ $$$$...

EUVD-2026-110528

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com", "Slack Token":...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...