Dylan Ayrey

Pastejacking. A demo of overriding what's in a person's clipboard

WPA2-HalfHandshake-Crack. This is a POC to show it is possible to capture enough of a handshake with a user from a fake AP to crack a WPA2 network without knowing the passphrase of the actual AP.

Snapper. A security tool for grabbing screenshots of many web hosts

cssInjection. Stealing CSRF tokens with CSS injection (without iFrames)

truffleHogRegexes. These are the regexes that power truffleHog

gcploit. These are tools we released with our 2020 defcon/blackhat talk https://www.youtube.com/watch?v=Ml09R38jpok

XSSJacking. Abusing Self-XSS and Clickjacking to trigger XSS

windowHijacking. A demo of altering an opened tab after a timer

AttackingAndDefendingTheGCPMetadataAPI. This repo gives an overview of some GCP metadata API attack and defend patterns

XSSOauthPersistence. Maintaining account persistence via XSS and Oauth

Damn-Vulnerable-Redis-Container. An example of obtaining RCE via Redis and CSRF

whatsinmyredis. A CSRF demonstration of stealing local Redis data, and encrypting all Redis instances on a local network

inputProtectionShield. Eagle

CORS. JSON API's Are Automatically Protected Against CSRF, And Google Almost Took It Away.

CSRF-PoC-Genorator. This is a simple CSRF Proof of Concept generator that supports multiple form encodings and methods

santaHog. Scans packages in npm and pypi for secrets

mimikittenz4Linux. Steals cleartext passwords from webservices, by reading the memory of browsers

clientHashing. A demonstration of secure hashing done client side

logger. Simple javascript logging of fingerprint, IP address and user agent

bygonessl. A tool to discover bygonessl vulnerabilities using the facebook API

SmartHealthCardViewer. Smart Health Card Viewer, view your California Smart Health Card Vaccination record

domainAbandonedDetector. Detects abandoned domains referenced in HTML

BitRush. An open source project for bitcoin mining on an FPGA

fierce. A DNS reconnaissance tool for locating non-contiguous IP space.

redirect_demo. HTML

dxa4481.github.io. This is my resume, in HTML/CSS

JayPi. Translating JTAGENUM to Python for the Raspberry Pi

gpsIoTTracker. This simple python module takes GPS locations of a moving object, and measured signal strengths of an IoT object and uses trilateration and the method of least squares to solve for the location of the object

JohnWilliams. JavaScript

security_reports. A simple template that can be used to deliver security reports either for bug bounties, internal reports, or consultancy work

Veyebrations. We are creating a system that translates measured distances of physical objects into vibrations to assist the blind

Open-Source-FPGA-Bitcoin-Miner. A completely open source implementation of a Bitcoin Miner for Altera and Xilinx FPGAs. This project hopes to promote the free and open development of FPGA based mining solutions and secure the future of the Bitcoin project as a whole. A binary release is currently available for the Terasic DE2-115 Development Board, and there are compile-able projects for numerous boards.

evilModel. Python

penguin. A restful single page app tool sharing application

SocialEngineeringPresentation. A simple presentation on social engineering

HIVStats. This application makes HIV statistics very accessible

coolSVGXSS. simple demo of XSS in an SVG

Tutorials. Learning new things

VibrationAPI. An example of the HTML5 vibration API

secretsandstuff.

log_handler. The backend log handler for logger.io

dotGitFinder. JavaScript

ShadowBuster. JavaScript

SecurityTarotCard. JavaScript

goproxy. An HTTP proxy library for Go

serviceworkerCSRFLogout. HTML

DNS-supplychain-frontend. JavaScript

evil-repo. "><script>prompt(1)</script>''"><!--<svg>

HelloShiftLeft-Mar2021. Java

blog. HTML

FingerprintPressure. This simple demo shows given an image of a fingerprint, you can determine how hard the person was pushing down

serverConfigs. The server configuration files for security.love and e-q.pw

insecureLamp. a very simple insecure web application designed to turn a lamp on and off

xsshunter-express. An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!

SeriousApiarist. Controlled builds, tests, static analysis, releases, and deploys with validation and 2FA and live streaming to your CI