HFish

HFish design concept HFish is a community free honeypot that focuses on enterprise security scenarios. It provides users with independently operable and practical functions from three scenarios: intranet loss detection, internet threat awareness, and threat intelligence production. It increases...

datadome-vm

DataDome VM Analysis Summary This repository documents the first public version of DataDome's in-browser JavaScript virtual machine VM used in their CAPTCHA/interstitial flow. This analysis covers: Bytecode loading and decoding mechanisms VM memory layout and architecture A proof-of-concept...

hashview

Hashview v0.8.2 Hashview is a tool for security professionals to help organize and automate the repetitious tasks related to password cracking. It is broken into two compoents, the Hashview Server, and Hashview Agent. The Hashview Server is a web application that manages one or more agents,...

0l4bs

0l4bs Cross-site scripting labs for web application security enthusiasts List of Chall : Chall 1 | URL Chall 2 | Form Chall 3 | User-Agent Chall 4 | Referrer Chall 5 | Cookie Chall 6 | LocalStorage Chall 7 | Login Page Chall 8 | File Upload Chall 9 | Base64 Encoding Chall 10 | Removes Alert Chall...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

adPEAS

adPEAS v2 — Active Directory Privilege Escalation Awesome Scripts Comprehensive Active Directory security assessment — zero dependencies, single file, ready to go. What is adPEAS? adPEAS is a PowerShell-based security assessment tool that identifies misconfigurations, vulnerabilities, and privile...

slsa

SLSA "salsa" is Supply-chain Levels for Software Artifacts SLSA pronounced "salsa" is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to bein...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

exploitation-course

OFFENSIVE SECURITY & REVERSE ENGINEERING OSRE Course This repository is for the Offensive Security and Reverse Engineering Offensive Software Exploitation Course I used to teaching at Champlain College and currently sharing it for free online check the YouTube channel for the recordings. Most of...

xpfarm

XPFarm An open-source AI-augmented offensive security platform that wraps well-known security tools behind a unified web UI — with distributed scanning, AI-generated reports, a smart scan planner, an interactive attack graph, and a community Plugin SDK. Also check out ObsidianBox Modern on Google...

TIWAP

Totally Insecure Web Application Project TIWAP TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities The application is...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

linux-smart-enumeration

First, a couple of useful oneliners ; wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh;chmod 700 lse.sh Note that...

wfuzz

Wfuzz - The Web Fuzzer Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload. A payload in Wfuzz is a source of data. This simple concept allows any input to ...

libssh-scanner

libssh scanner: CVE-2018-10933. It'll scan for vulnerable server for CVE-2018-10933 based on ssh's banner. This scanner is based on the work of Leap Security. USAGE libssh-scan...

trajan

Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan parses workflow YAML files, builds dependency graphs, runs...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

Adversarial-Detection-Engineering-Framework

Adversarial Detection Engineering ADE Framework Get ahead of False Negatives by understanding how detection logic fails before threat actors abuse it. Check out the website: https://adeframework.org/ What Is ADE? Adversarial Detection Engineering ADE is the discipline of reasoning about False...

trailmark

Trailmark Parse source code into queryable graphs of functions, classes, calls, and semantic annotations for security analysis. Trailmark uses tree-sitter for language-agnostic AST parsing and rustworkx for high-performance graph traversal. The long-term vision is to combine this graph with...

Nebula

Nebula Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...