Shubs

Tracehound.

BurnMap. Python

StarkGuard. Python

wakaru. 🔪📦 Javascript decompiler for modern frontend

akstretch. Ableton Live extension — cyclic OLA time stretch

privacy-parser. Reverse of OpenAI Privacy Filter: same 1.5B model, returns PII as structured spans instead of masking.

Snaffalyzer. A parser and triage dashboard for Snaffler security scan logs

vulnerability-spoiler-alert-action. GitHub Action to alert on security patches before the CVE drops.

React2Shell-CVE-2025-55182-original-poc. Original Proof-of-Concepts for React2Shell CVE-2025-55182

xxe-smb-server. 在xxe中使用smb外带多行内容

multigres. Vitess for Postgres

jxscout. jxscout superpowers JavaScript analysis for security researchers

slice. SAST + LLM Interprocedural Context Extractor

kingfisher. Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. 950+ rules.

ai4eh. AI for Ethical Hacking - Workshop

from-day-zero-to-zero-day. Scripts and examples for "From Day Zero to Zero Day" by Eugene Lim.

go-react-typescript-template. 📦 Starter template for a fullstack web application using Go and React with TypeScript.

httptap. View HTTP/HTTPS requests made by any Linux program

Malimite. iOS and macOS Decompiler

lorito. Elixir

ogp-ctf-2024. A web CTF for training developers in bug hunting and secure coding!

MegaParse. File Parser optimised for LLM Ingestion with no loss 🧠 Parse PDFs, Docx, PPTx in a format that is ideal for LLMs.

lightyear. lightyear is a tool to dump files in tedious (blind) conditions using PHP filters

risky-records. Given a list of domains and known IP and buckets that are owned, which might be susceptible to domain hijacking?

certainly. Certainly is a offensive security toolkit to capture large amounts of traffic in various network protocols in bitflip and typosquat scenarios.

req. Simple Go HTTP client with Black Magic

bypass-bot-detection. Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection

clairvoyancex. Obtain GraphQL API schema despite disabled introspection!

cnext-exploits. Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()

CodeSheriff.NET. C#

Recaf. The modern Java bytecode editor

dive. A tool for exploring each layer in a docker image

Zero-E. Automates the network enumeration process in a fire-and-forget manner, among many more powerful functions. Zero effort, zero error network enumeration.

HttpRemotingObjRefLeak. Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)

Todesstern. A simple mutator engine which focuses on finding unknown classes of injection vulnerabilities

nmapurls. Nmapurls parses Nmap xml reports from either piped input or command line arg and outputs a list of http(s) URL's to be used in an automation pipeline.

hackvertor. Java

pyyso. pyyso is a Python package that generate java serialized poc. Including CommonsCollections1-7, JDK7u21, JDK8u20, ldap for jndi, shiro-550, CommonsBeanutils1 no cc, JRMPClient, high version JDK Bypass, Fake MySQL for JDBC attack

legba. The fastest and more comprehensive multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷

PIPE. Prompt Injection Primer for Engineers

humanify. Deobfuscate Javascript code using ChatGPT

wapalyzer. 🌐 Identify the technologies powering any website. This is a fork of the now deleted Wappalyzer project by @AliasIO and community.

aws-security-survival-kit. Bare minimum AWS Security Alerting and Secure by default Configuration

noir. Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

grepaddr. Use grepaddr to extract (grep) all kinds of addresses from stdin like URLs (incl. IPv4/IPv6), IP addresses & ranges (IPv4/IPv6), e-mail addresses, MAC addresses.

curlshell. reverse shell using curl

nuclei-wordfence-cve. 75k+ WordPress Nuclei templates, updated daily from Wordfence intel—filter by severity/tags/CVE and scan in one line. 🚀🔒

shortscan. An IIS short filename enumeration tool

route-detect. Find authentication (authn) and authorization (authz) security bugs in web application routes.

jsluice. Extract URLs, paths, secrets, and other interesting bits from JavaScript

rate-limit-queue. An implementation of rate limited queues in Python, thread-safe, using only built-in components

pure-sh-bible. 📖 A collection of pure POSIX sh alternatives to external processes.

rogue_mysql_server. A rouge mysql server supports reading files from most mysql libraries of multiple programming languages.

ShadowClone. Unleash the power of cloud

EC2StepShell. EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.

cariddi. Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

apk-mitm. 🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

grepmarx. A source code static analysis platform for AppSec enthusiasts.

rsu-cracker. Rust

graphicator. A GraphQL enumeration and extraction tool

interactsh-client-python. Python

hot-jar-swapping-urlclassloader. Demo of the URLClassLoader JAR-swapping showing the ability to replace and exploit an already loaded JAR with inner classes

GadgetProbe. Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

WordList. Hack

api_wordlist. A wordlist of API names for web application assessments

ermir. an Evil Java RMI Registry.

through_the_wire. CVE-2022-26134 Proof of Concept

ObjectPwnStream. a Ruby implementation of Java's ObjectInputStream and ObjectOutputStream.

jarjarbigs. A python script to merge multiple jar files for easier debugging via JD-Eclipse

CVE-2022-30781. 🍵 Gitea repository migration remote command execution exploit.

bud. The Full-Stack Web Framework for Go

grpcurl. Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers

cero. Scrape domain names from SSL certificates of arbitrary hosts

security-labs-pocs. Proof of concept code for Datadog Security Labs referenced exploits.

redirex. tool that generates bypasses for open redirects

cdn-proxy. Bypass CDN and WAF restrictions using CDN re-fronting.

pgcat. PostgreSQL pooler with sharding, load balancing and failover support.

onionpipe. Onion addresses for anything.

cookiecutter-click. A Python cookiecutter template to help you start a Click project.

mmk-ui-api. UI, API, and Scanner (Rules Engine) services for Merry Maker

hardcidr. hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime.

har-viewer. Har Har Har Viewer

jamf-log4j. Python

badblood. SonicWall SMA-100 Unauth RCE Exploit (CVE-2021-20038)

ripgen. Rust-based high performance domain permutation generator.

spring-boot-upload-file-lead-to-rce-tricks. spring boot Fat Jar 任意写文件漏洞到稳定 RCE 利用技巧

osmedeus-base. Build your own reconnaissance system with Osmedeus Next Generation

JNDI-Exploit-Kit. JNDI-Exploitation-Kit（A modified version of the great JNDI-Injection-Exploit created by @welk1n. This tool can be used to start an HTTP Server, RMI Server and LDAP Server to exploit java web apps vulnerable to JNDI Injection）

chronorace. Python

driftwood. Private key usage verification

jolokia-exploitation-toolkit. jolokia-exploitation-toolkit

threatcl. Documenting your Threat Models with HCL

go-whois. get WHOIS with library, command or through HTTP server

haptyc. Python

advisories. HTML

RCE-0-day-for-GhostScript-9.50. RCE 0-day for GhostScript 9.50 - Payload generator

BurpSuiteAutoRepeaterNaming. This extension replaces the default repeater tab name with the URL path of the repeater request.

graphw00f. graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.

SerializationDumper. A tool to dump Java serialization streams in a more human readable form.

ds_store_exp. A .DS_Store file disclosure exploit. It parses .DS_Store file and downloads files recursively.

heapdump_tool. heapdump敏感信息查询工具，例如查找 spring heapdump中的密码明文，AK,SK等

xsshunter-express. An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!

active-scanning-techniques. A compilation of network scanning strategies to find vulnerable devices

svn-extractor. simple script to extract all web resources by means of .SVN folder exposed over network.

CVE-2021-33564. Argument Injection in Dragonfly Ruby Gem

armada. A high performance TCP SYN port scanner.

fhttp. The f stands for flex.

RCEvil.NET. C#

baserunner. A tool for exploring Firebase datastores.

kiterunner. Contextual Content Discovery Tool

goop. Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.

BurpSuiteAutoCompletion. This exention enables autocompletion within BurpSuite Repeater/Intruder tabs.

sns. IIS shortname scanner written in Go

dmut. A tool to perform permutations, mutations and alteration of subdomains in golang.

gopher-tomcat-deployer. Gopher Tomcat Deployer

emba. EMBA - The firmware security analyzer

OneListForAll. Rockyou for web fuzzing

Unsafe-JAX-RS-Burp. Burp Suite extension for JAX-RS

docker_explorer. Scan DockerHub images that match a keyword to find secrets.

rusty-hog. A suite of secret scanners built in Rust for performance. Based on TruffleHog (https://github.com/dxa4481/truffleHog) which is written in Python.

semgrep. Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

gosecretsdump. Dump ntds.dit really fast

turner. SOCKS5 and HTTP over TURN/STUN proxy

symfony-exploits. Exploits targeting Symfony

aws_stealth_perm_enum. Research on the enumeration of IAM permissions without logging to CloudTrail

burp-multiplayer. Burp with Friends

Spring-Boot-Vulnerability.

Carnivore. Microsoft External Attack Tool

chrome-extension-manifests-dataset. >100K Chrome Extension manifest.json files for analysis

resolvers. List of periodically validated public DNS resolvers

hack-requests. The hack-requests is an http network library for hackers

daily-commonspeak2. commonspeak2 subdomains wordlist generated daily **DEPRECATED** The author(s) of commonspeak2 maintain an official repo with more lists. Please use it instead: https://github.com/assetnote/wordlists

abnormalizer. unicode abnormalizer to takes a unicode string and abnormalizes it by character replacment

content-type-research. Content-Type Research

vscode-sops. TypeScript

smogcloud. Find cloud assets that no one wants exposed 🔎 ☁️

TLS-poison. Rust

aws_exposable_resources. Resource types that can be publicly exposed on AWS

zen-sec.github.io. A repository for the people

teknogeek. pwn

pymultitor. PyMultitor - Python Multi Threaded Tor Proxy

panos-scanner. Determine the Palo Alto PAN-OS software version of a remote GlobalProtect portal or management interface.

browservice. Browservice: Browse the modern web on historical browsers

smuggler. Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3

qiling. A True Instrumentable Binary Emulation Framework

webpack-exploder. Unpack the source code of React and other Webpacked apps!

SMBGhost. Scanner for CVE-2020-0796 - SMBv3 RCE

PoC-in-GitHub. 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

debugtron. Debug in-production Electron based app

tailscale. The easiest, most secure way to use WireGuard and 2FA.

uxss-db. 🔪Browser logic vulnerabilities :skull_and_crossbones:

spraykatz. Credentials gathering tool automating remote procdump and parse of lsass process.

burp-scope-monitor. Burp Suite Extension to monitor new scope

dtd-finder. List DTDs and generate XXE payloads using those local DTDs.

httprebind. Automatic tool for DNS rebinding-based SSRF attacks

PMapper. A tool for quickly evaluating IAM permissions in AWS.

ja3. JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

http-request-smuggler. Java

sprinter.js. Tools for GitHub issue and milestone consolidation across projects.

CVE-2019-12476. JavaScript

octosql. OctoSQL is a query tool that allows you to join, analyse and transform data from multiple databases and file formats using SQL.

secretz. secretz, minimizing the large attack surface of Travis CI

tko-subs. A tool that can help detect and takeover subdomains with dead DNS records

liffy. Local file inclusion exploitation tool

BlueKeep. Proof of concept for CVE-2019-0708

can-i-take-over-xyz. "Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

SSHoRTy. A progressive, customizable armored SSH tunnel implant for Linux and MacOS systems

websocat. Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions

adidnsdump. Active Directory Integrated DNS dumping by any authenticated user

PySnooper. Never use print for debugging again

viewgen. Viewgen is a ViewState tool capable of generating both signed and encrypted payloads with leaked validation keys

jingo. This package provides the ability to encode golang structs to a buffer as JSON very quickly.

sic. A tool to perform Sequential Import Chaining

anew. A tool for adding new lines to files, skipping duplicates

inql. InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

poc-graphql. Research on GraphQL from an AppSec point of view.

commando-vm. Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

NotQuite0DayFriday. This is a repo which documents real bugs in real software to illustrate trends, learn how to prevent or find them more quickly.

npk. A mostly-serverless distributed hash cracking platform

graudit. grep rough audit - source code auditing tool

ghidra_scripts. Scripts for the Ghidra software reverse engineering suite.

go-jamcracker. a simple animal jam brute force password cracker with concurrency

vue-form-wizard. Vue.js 2 wizard

CVE-2019-7642.

CVE-2018-6389. CVE-2018-6389 Exploit In WordPress DoS

CVE-2019-6340. Environment for CVE-2019-6340 (Drupal)

aws-sdk-js. AWS SDK for JavaScript v2 (End-of-Life as of 09/08/2025). The AWS SDK for JavaScript v3 in the browser and Node.js is available here: https://github.com/aws/aws-sdk-js-v3

cidrize. IP address parsing for humans.

shuttle. A web proxy in Golang with amazing features.

struts-any-results. Demonstrating why Dynamic Method Invocation with unrestricted method names (the old default of Struts) is dangerous.

DNSGrep. Quickly Search Large DNS Datasets

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

beemka. Basic Electron Exploitation

program.

turbo-intruder. Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.

filepath-securejoin. Proposed filepath.SecureJoin implementation

hexyl. A command-line hex viewer

fingerping. A security tool to fingerprint PNG libraries used by web applications

Cobra. Source Code Security Audit (源代码安全审计)

laravel-poc-CVE-2018-15133. PoC for CVE-2018-15133 (Laravel unserialize vulnerability)