cset

What is CSET? The Cybersecurity Infrastructure Security Agency CISA and the Idaho National Laboratory INL develop the Cyber Security Evaluation Tool CSET® for asset owners with the primary objective of reducing the risk to the nation’s critical infrastructure. Control systems are defined as...

APKLab

APKLab The ultimate Android RE experience right inside your VS Code. APKLab seamlessly integrates the best open-source tools: Apktool, smali-lsp, Jadx, uber-apk-signer, apk-mitm and more to the excellent VS Code so you can focus on app analysis and get it done without leaving the IDE. Features...

Resources-for-Beginner-Bug-Bounty-Hunters

Resources-for-Beginner-Bug-Bounty-Hunters Intro Current Version: 2023.01 Welcome to our web hacking and bug bounty hunting resource repository! A curated collection of web hacking tools, tips, and resources is available here. We hope that this repository will be a valuable resource for you as you...

0day-security-software-vulnerability-analysis-technology

0day-security-software-vulnerability-analysis-technology Notes on Using the Companion Resource Pack for "0day Security: Software Vulnerability Analysis Technology Second Edition" The materials in this resource pack are for learning purposes only. No organization, individual, or institution may us...

capsule

Getting Started • Documentation • Issues • Contributing Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : Set CPU, memory, a...

CVE-2025-63914

CVE-2025-63914 Public disclosure and patch for CVE-2025-63914: Zip bomb vulnerability in Cinnamon/kotaemon. Credit Wang Yuanrong Summary The mayextractzip function fails to enforce limits on ZIP decompression, allowing a malicious ZIP bomb to trigger excessive resource consumption and denial of...

featherduster

FeatherDuster and Cryptanalib FeatherDuster is a tool written primarily by Daniel "unicornfurnace" Crowley, along with community contributions, for breaking crypto; It tries to make the process of identifying and exploiting weak cryptosystems as easy as possible. Cryptanalib is the moving parts...

aws-inventory

Introduction This is a tool that tries to discover all AWS resources created in an account. AWS has many products a.k.a. services with new ones constantly being added and existing ones expanded with new features. The ecosystem allows users to piece together many different services to form a...

awesome-soc-analyst

awesome-soc-analyst We just collected useful resources for SOC analysts and SOC analyst candidates. This repository is maintained by LetsDefend. Feel free to add new resources here. Table of Contents Books Malware Analysis Practice Labs Phishing Analysis Tools for Investigation Network Log Source...

awesome-shodan-queries

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the literal internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild. Most...

htb-writeups

Hack The Box Writeups - The Ultimate HTB Resource The most comprehensive collection of Hack The Box writeups , walkthroughs , and cheatsheets on GitHub. 500+ machines, 400+ challenges, ProLabs, Sherlocks DFIR, CTF events, penetration testing methodology, and OSCP/CPTS certification prep - all in...

CVE20265172poc

CVE20265172poc CVE-2026-5172: buffer overflow in extractaddresses on crafted resource record PoC Topology read here https://medium.com/@yanyuyingshu/reproduction-journal-dnsmasq-ecs-validation-and-buffer-overflow-flaws-e0fe0f66f60c Steps​ 1. vi /etc/dnsmasq.conf​ port=5353​...

BurpSuiteJSBeautifier

Burp Suite JSBeautifier Most of the websites compress their resources such as JS files in order to increase the loading speed. However, security testing and debugging a compressed resource is not an easy task. This is a Burp Suite open source extension which makes it possible to beautify most of...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CloudBrute

CloudBrute A tool to find a company target infrastructure, files, and apps on the top cloud providers Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode. The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. The complete writeup is available. here ...

CloudScraper

CloudScraper is a Tool to spider and scrape targets in search of cloud resources. Plug in a URL and it will spider and search the source of spidered pages for strings such as 's3.amazonaws.com', 'windows.net' and 'digitaloceanspaces'. AWS, Azure, Digital Ocean resources are currently supported...

CyberSources

Welcome to the Cybersources! This project serves as a central hub for a wide range of tools, resources, and educational materials designed for cybersecurity professionals, enthusiasts, and learners. Whether you're just starting out or an experienced expert, you'll find everything you need to...

logrus-dos-poc

CVE-2025-65637: Logrus Denial of Service Vulnerability This directory contains proof-of-concept code and test scripts for the Denial of Service DoS vulnerability in github.com/sirupsen/logrus, assigned as CVE-2025-65637. Vulnerability Summary CVE ID : CVE-2025-65637 CWE : CWE-400 Uncontrolled...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF Vulnerability 📌 Overview CVE-2026-44578 is a high-severity Server-Side Request Forgery SSRF vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to...

viber-desktop-html-injection

Viber Desktop — HTML Injection CVE-2025-55996 CVE: CVE-2025-55996 Discoverer: Thaw Khant Cycbake Product: Viber Desktop Affected: Viber Desktop 25.6.0 and possibly earlier Summary Viber Desktop's deep-link handler viber://forward?text= can render unsanitized HTML supplied in the text parameter...