Jonas Lejon

malicious-pdf. 💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

tor-fingerprint. Tor Browser and Tails version fingerprint PoC

lolcrawler. Headless web crawler for bugbounty and penetration-testing/redteaming

Pentest-Tools.

awesome-pentest. A collection of awesome penetration testing resources, tools and other shiny things

ct-monitor. Certificate Transparency Log Monitor

dirs3arch. HTTP(S) directory/file brute forcer

api-hacker. Reads and Swagger/OpenAPI JSON file and routes the requests via Burp Suite

powershell-backdoor-generator. Reverse backdoor written in PowerShell and obfuscated with Python. It generates payloads for popular hacking devices like Flipper Zero and Hak5 USB Rubber Ducky, and changes its signature after every build for evasion.

ad-autopwn. AD AutoPwn v4.10.0 — automated AD attack chain, zero-auth to Domain Admin. Discover/Kerberoast/AS-REP/AD CS ESC1-16/Shadow Creds/RBCD+KCD/Ghost-SPN/TGS-rewrite/Dollar-Ticket/WPAD/WSUS/PXE/SCCM/BloodHound auto-action/Loot/DCSync/DPAPI + Synacktiv 2026 reflection (CVE-2025-58726/2026-24294/2026-26128). Authorized pentesting only.

apt10. APT / Cloud Hopper Yara rules

PyShell. Multiplatform Python WebShell

SecLists. SecLists is the security tester's companion. It is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more.

ssh-eol-checker. Nmap SSH Banner EOL Checker - Identifies Ubuntu and Debian versions from SSH banners and checks their EOL status

homebrew-cask. 🍻 A CLI workflow for the administration of macOS applications distributed as binaries

jonaslejon.

EmailChecker. Disposable email detection library for PHP

keepass-dump. CLI to dump a KeePass database

Kalkun. Open Source Web based SMS Management

awesome-wordpress. A curated list of amazingly awesome WordPress resources, themes, plugins and shiny things. Inspired by awesome-php.

pizero-usb-hid-keyboard. Fake a raspberry pi zero w to look like a keyboard to a Windows 10 PC

pcap-mitm-fuzz0r. Fuzz servers and clients using pcaps or mitm based approaches

subfinder. Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

lockc. Making containers more secure with eBPF and Linux Security Modules (LSM)

maltrail. Malicious traffic detection system

burp_log_parser. Python script to parse Burp Suite log files

openvpn-fingerprint. OpenVPN Fingerprinting Tool