Ajin Abraham

nodejsscan. nodejsscan is a static security code scanner for Node.js applications.

CMSScan. CMS Scanner: Scan Wordpress, Drupal, Joomla, vBulletin websites for Security issues

OWASP-Xenotix-XSS-Exploit-Framework. OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework.

Xenotix-Python-Keylogger. Xenotix Python Keylogger for Windows.

njsscan. njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

Node.Js-Security-Course. Contents for Node.Js Security Course

Droid-Application-Fuzz-Framework. Android application fuzzing framework with fuzzers and crash monitor.

libsast. Generic SAST Library

WebAppSec. Web Application Security

Static-DOM-XSS-Scanner. Static DOM XSS Scanner is a Static Analysis tool written in python that will iterate through all the JavaScript and HTML files under the given directory and will list out all the possible sources and sinks that may cause DOM XSS. At the end of the scan, the tool will generate an HTML report.

Xenotix-APK-Reverser. Xenotix APK Reverser is an OpenSource Android Application Package (APK) decompiler and disassembler powered by dex2jar, baksmali and jd-core.

aws_security_tools. Scripts and tools for AWS Pentest

Mobile-Security-Framework-MobSF. Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

PoC. Proof of Concepts, Exploits

njsscan-action. nodejsscan Github Action

Xenotix-xBOT. Xenotix xBOT is a Cross Platform PoC Bot that abuse certain Google Services to implement it's C&C

WhatsApp-AutoClean. WhatsApp AutoClean is an android app that removes all WhatsApp media (images, videos, sound etc) and hide them from being shown in Gallery

tizen-security. Tools made for Tizen Security Analysis

Exploit-Research-Ported. Exploit Research & Development - Ported Exploits

package_scan. PoC: Python package static and dynamic analysis to detect environment variable stealing

bugbounty-cheatsheet. A list of interesting payloads, tips and tricks for bug bounty hunters.

MobileApp-Pentest-Cheatsheet. The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.

node.js-simple-https-server. A simple HTTPS server that uses self signed certificate. Useful for PoC purposes

OAuth-Request-Crafter. OAuth Request Crafter

Android-SSL-Certificate-Pinning. A sample android application implementing Moxie's Certificate Pinning Library

bad_python_extract. A vulnerable web application written in Python Flask to demonstrate insecure file extraction

JSComm-API-Hooker. Tool to hook all communication APIs including XHR/XHR2, WebSockets, Web Workers, PostMessage and Server Sent Events

awesome-web-security. 🐶 A curated list of Web Security materials and resources.

OpSec-Firefox-Addon-Exploit-Suite. OpSec Firefox Addon Exploit Suite is a POC application that demonstrate various flaws in the Firefox Add-on Security Model.

Vulnerable_Tornado_App. An intentionally vulnerable web application written in Python using Tornado

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

API-Security-Checklist. Checklist of the most important security countermeasures when designing, testing, and releasing your API

AutomatingWindowsPrivilegeEscalation. Python

WindowsExploits. Windows exploits, mostly precompiled.

AuditDroid. AduitDroid

CSS-Keylogging. Chrome extension and Express server that exploits keylogging abilities of CSS.

iSpy. A reverse engineering framework for iOS

usbkill. usbkill waits for a change on your usb ports, then immediately kills your computer. Anti forensic, usb -> kill

proxy2. HTTP/HTTPS proxy in a single python script

python-hash-calculator. Python Hash Calculator

airgeddon. This is a multi-use bash script for Linux systems to audit wireless networks.

poc-rogue. Python

android-unpacker. Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0

play-scraper. A web scraper to retrieve application data from the Google Play Store.

dvna. Damn Vulnerable NodeJS Application

injectAllTheThings. Seven different DLL injection techniques in one single project.

lobotomy. Android Reverse Engineering Framework & Toolkit

iloot. OpenSource tool for iCloud backup extraction

ActiveScanPlusPlus. ActiveScan++ Burp Suite Plugin

InsecureProgramming. mirror of gera's insecure programming examples | http://community.coresecurity.com/~gera/InsecureProgramming/

CodeMirror. In-browser code editor

how2heap. A repository for learning various heap exploitation techniques.

nimbostratus. Tools for fingerprinting and exploiting Amazon cloud infrastructures

apache-struts2-CVE-2017-5638. Demo Application and Exploit