Moamen Basel

cmux. Open source Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents. Built for multitasking, organization, and programmability.

agentic-inbox. A self-hosted email client with an AI agent, running entirely on Cloudflare Workers

pxpipe. cut Fable 5 token usage by rendering text context as images

caveman. 🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman

strix. Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

pesty. Free, open-source clipboard manager for macOS a native Paste app alternative with color-coded history, pinboards, search & keyboard paste. Signed, notarized, Homebrew.

Immunefi-bug-bounty-writeups-list. curation of all(most) immunefi bug bounty writeups I could find(till now)

claude-code-statusline. Shell

Awesome-Smart-Contract-Security. A curated list of Smart Contract Security materials and resources For Researchers

openvpn3-indicator. Simple GTK indicator GUI for OpenVPN 3 Linux

notebooklm-py. Unofficial Python API and agentic skill for Google NotebookLM. Full programmatic access to NotebookLM's features—including capabilities the web UI doesn't expose—via Python, CLI, and AI agents like Claude Code, Codex, and OpenClaw.

reverse-skill. Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients 逆向/渗透/安全技能路由包 - AI 自动路由 + 按需自举工具链 + 自动进化经验库 | 支持 Claude Code / Kiro / Cursor / Cline 等代码 AI 客户端

ponytail. Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

claude-code-tips. 40+ tips for getting the most out of Claude Code, from basics to advanced - includes a custom status line script and Claude Code running itself in a container. Also includes the dx plugin: skills for everyday dev workflows.

container. A tool for creating and running Linux containers using lightweight virtual machines on a Mac. It is written in Swift, and optimized for Apple silicon.

cua. Open-source infrastructure for Computer-Use Agents. Sandboxes, SDKs, and benchmarks to train and evaluate AI agents that can control full desktops (macOS, Linux, Windows).

gitpulse. Animated GitHub PR triage dashboard - replaces messy notifications with a prioritized action center. Pull your own data locally via gh CLI.

naggets. old CTF I've made sharing it publicly.

vulnhawk. AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

AutoWIFI. Wireless penetration testing framework. Automates WPA/WPA2/WEP/WPS attacks - recon to exploitation in one command. aircrack-ng + hashcat + PMKID.

AgentGuard. AI Agent Supply Chain Security - intercepts and validates every package install, git clone, and script download triggered by AI coding agents before execution

CryptoGuard. AI agent safety layer for crypto transactions - blocks honeypots, blacklists, and rug pulls before they happen

htb-writeups. The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

keyFinder. Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

quiet-operator. A purple-team field manual for staying stealthy on the host and on the wire. Linux-first. Every offensive page paired with detection telemetry.

Phosphor. Free and open-source iOS device manager for macOS. Browse backups, export messages, extract photos, manage apps - no subscriptions, no iCloud lock-in.

puresnitch. Free, open-source application firewall for macOS. Little Snitch alternative with zero telemetry. Native SwiftUI world map, rules manager, DNS over HTTPS, pf-based blocking. Signed, notarized, MIT licensed.

gitpulse. Animated GitHub PR triage dashboard - replaces messy notifications with a prioritized action center. Pull your own data locally via gh CLI.

PureMac. Free, open-source macOS cleaner. CleanMyMac alternative with zero telemetry. Native SwiftUI, scheduled auto-cleaning, Xcode/Homebrew/system cache cleanup. MIT licensed.

greycorelabs.github.io. github page

superpowers. An agentic skills framework & software development methodology that works.

defending-code-reference-harness. Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

quiet-operator. A purple-team field manual for staying stealthy on the host and on the wire. Linux-first. Every offensive page paired with detection telemetry.

Talks. A simple reference for all of my public talks

new-google-unlocked. Modernized Google Unlocked - Manifest V3, XSS-hardened, with extra DMCA/SERP bypasses and archive fallbacks

cryptowatcher. watching price of crypto changes in your terminal using NodeJS

bitstable. Bitcoin trading bot bulit using NodeJS

momenbasel.

solidity-security-blog. Comprehensive list of known attack vectors and common anti-patterns

puresnitch. Free, open-source application firewall for macOS. Little Snitch alternative with zero telemetry. Native SwiftUI world map, rules manager, DNS over HTTPS, pf-based blocking. Signed, notarized, MIT licensed.

claude-for-legal. A suite of plugins for legal workflows

bounty-targets-data. This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

trailmark. Build and query a graph database representation of source code

ConsoleMini. Turn a Mac mini into a living-room retro/PS console - beautiful big-picture launcher (Electron + React)

timenest. Network Time Machine for every Mac on your LAN. Runs on Mac mini, Raspberry Pi, or any home server. Docker stack: Samba + vfs_fruit, Avahi Bonjour discovery, FastAPI admin UI.

awesome-mac-mini-homeserver. 260+ curated tools, guides, and projects for turning an Apple Silicon Mac mini into a 24/7 agentic AI home server. Ollama, Claude Code, Jellyfin, Vaultwarden, Home Assistant, and more - with one-command installers.

magika. Fast and accurate AI powered file content types detection

momenbasel.github.io. Personal blog

cyfrin-audit-reports. A list of public audit reports conducted by the Cyfrin team

liffier. Path traversal / LFI fuzzer in Go - 66 encoding bypass techniques, response analysis, goroutine concurrency, wordlist support, proxy (Burp/Caido).

gorobots. gorobots - robots.txt recon & path discovery in Go. Structured parsing, 29-category sensitivity classification, concurrent path probing, bulk domain scanning.

malware-check. Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Phosphor. Free and open-source iOS device manager for macOS. Browse backups, export messages, extract photos, manage apps - no subscriptions, no iCloud lock-in.

NtWarden. Windows Analysis and Research Toolkit

shodscript. Automate exploit/PoC execution against Shodan search results - concurrent dispatch, filtering, structured output, and export.

AgentGuard. AI Agent Supply Chain Security - intercepts and validates every package install, git clone, and script download triggered by AI coding agents before execution

CryptoGuard. AI agent safety layer for crypto transactions - blocks honeypots, blacklists, and rug pulls before they happen

AutoWIFI. Wireless penetration testing framework. Automates WPA/WPA2/WEP/WPS attacks - recon to exploitation in one command. aircrack-ng + hashcat + PMKID.

ipsw. iOS/macOS Research Swiss Army Knife

markitdown. Python tool for converting files and office documents to Markdown.

claude-code-best-practice. from vibe coding to agentic engineering - practice makes claude perfect

Broken-Vulnerable-Code-Snippets. A small collection of vulnerable code snippets

htb-writeups. The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

HUNT. Python

grafana. The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

loki. Like Prometheus, but for logs.

influxdb. Scalable datastore for metrics, events, and real-time analytics

Graphite. Community-built comprehensive 2D content creation appplication for graphic design, digital art, and interactive real-time motion graphics powered by a node-based procedural graphics engine

jaeger-ui. Web UI for Jaeger

jaeger. CNCF Jaeger, a Distributed Tracing Platform

awesome-llm-skills. A curated list of awesome LLM and AI Agent Skills, resources and tools for customising AI Agent workflows - that works with Claude Code, Codex, Gemini CLI and your custom AI Agents

get-shit-done. A light-weight and powerful meta-prompting, context engineering and spec-driven development system for Claude Code by TÂCHES.

awesome. 😎 Awesome lists about all kinds of interesting topics

prompts.chat. f.k.a. Awesome ChatGPT Prompts. Share, discover, and collect prompts from the community. Free and open source — self-host for your organization with complete privacy.

build-your-own-x. Master programming by recreating your favorite technologies from scratch.

lazygit. simple terminal UI for git commands

playwright. Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API.

awesome-mac.  This project is dedicated to collecting high-quality macOS software and organizing them systematically by different categories for easy search and use.

revanced-manager. 💊 Application to use ReVanced on Android

llama_index. LlamaIndex is the leading document agent and OCR platform

career-ops. Open-source AI job search: scan job portals, score listings A-F, tailor your CV, track applications — runs locally in your AI coding CLI (Claude Code, Gemini, Codex, OpenCode…)

google_dork_list. Google Dorks | Google helps you to find Vulnerable Websites that Indexed in Google Search Results. Here is the latest collection of Google Dorks. A collection of 13.760 Dorks. Author: Jolanda de Koff

exo. Run frontier AI locally.

vllm. A high-throughput and memory-efficient inference and serving engine for LLMs

open-skills. OpenSkills: Run Claude Skills Locally using any LLM

paperclip. The open-source app everyone uses to manage agents at work

codeql. CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

airgeddon. This is a multi-use bash script for Linux systems to audit wireless networks.

metasploitable3. Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.

EyeWitness. EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

iOS-Pentesting. Wiki for Pentesting iOS apps

awesome-ios-security. A curated list of awesome iOS application security resources.

igoat. OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

iOS. Most usable tools for iOS penetration testing

sipvicious. SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.

awesome-php-security. Awesome PHP Security Resources 🕶🐘🔐

vps-audit. lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers.

llm-guard. The Security Toolkit for LLM Interactions

ContainerSSH. ContainerSSH: Launch containers on demand

Pentest-Windows. ⚔️Windows11 Penetration Suite Toolkit 🔰 The First Windows Penetration Testing Environment on Mac M Chips

IntelOwl. IntelOwl: manage your Threat Intelligence at scale

cameradar. Cameradar hacks its way into RTSP videosurveillance cameras

terrascan. Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

AutoSploit. Automated Mass Exploiter

ThreatMapper. Open Source Cloud Native Application Protection Platform (CNAPP)

awesome-security-hardening. A collection of awesome security hardening guides, tools and other resources

RedTeam-Tools. Tools and Techniques for Red Team / Penetration Testing

rengine. reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

bandit. Bandit is a tool designed to find common security issues in Python code.

scapy. Scapy: the Python-based interactive packet manipulation program & library.

prowler. Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

wazuh. Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

fail2ban. Daemon to ban hosts that cause multiple authentication errors

gitleaks. Find secrets with Gitleaks 🔑

trivy. Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

requests-ip-rotator. A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

urlhunter. a recon tool that allows searching on URLs that are exposed via shortener services

BurpBounty. Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

Awesome-RCE-techniques. Awesome list of step by step techniques to achieve Remote Code Execution on various apps!

HolyTips. A Collection of Notes, Checklists, Writeups on Bug Bounty Hunting and Web Application Security.

Dictionary-Of-Pentesting. Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

subjack. DNS Takeover tool written in Go

x8. Hidden parameters discovery suite

OWASP-Web-Checklist. OWASP Web Application Security Testing Checklist

caido. 🚀 Caido releases, wiki and roadmap

gitGraber. gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

jaeles. The Swiss Army knife for automated Web Application Testing

Sudomy. Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting

uncover. Quickly discover exposed hosts on the internet using multiple search engines.

Awesome-OSINT-List. 📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.

gospider. Gospider - Fast web spider written in Go

ParamSpider. Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

awesome-oneliner-bugbounty. A collection of awesome one-liner scripts especially for bug bounty tips.

OneListForAll. Rockyou for web fuzzing

awesome-mobile-security. An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

vulnerability-Checklist. This repository contain a lot of web and api vulnerability checklist , a lot of vulnerability ideas and tips from twitter

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

knockpy. Knock Subdomain Scan

interactsh. An OOB interaction gathering server and client library

dalfox. 🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

hackerone-reports. Top disclosed reports from HackerOne

scan4all. Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

apkleaks. Scanning APK file for URIs, endpoints & secrets.

osmedeus. A Modern Orchestration Engine for Security

AllAboutBugBounty. All about bug bounty (bypasses, payloads, and etc)

HowToHunt. Collection of methodology and test case for various web vulnerabilities.

reconftw. reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

bbot. The recursive internet scanner for hackers. 🧡

OneForAll. OneForAll是一款功能强大的子域收集工具

httpx. httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

awesome-hacker-search-engines. A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

Resources-for-Beginner-Bug-Bounty-Hunters. A list of resources for those interested in getting started in bug bounties

subfinder. Fast passive subdomain enumeration tool.

dirsearch. Web path scanner

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

collisions. Hash collisions and exploitations

hacker-roadmap. A collection of hacking tools, resources and references to practice ethical hacking.

shannon. Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

sherlock. Hunt down social media accounts by username across social networks

Raccoon. A high performance offensive security tool for reconnaissance and vulnerability scanning

osv-scanner. Vulnerability scanner written in Go which uses the data provided by https://osv.dev

xray. 一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

n8n. Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

leaky-paths. A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

awesome-burp-extensions. A curated list of amazingly awesome Burp Extensions

Interceptor. Agent-driven Chrome extension for full browser control via CLI

nuclei-templates. Community curated list of templates for the nuclei engine to find security vulnerabilities.

re-mcp. A headless MCP server for IDA Pro and Ghidra

vulnhawk. AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

Web-Attack-Cheat-Sheet. Web Attack Cheat Sheet

PureMac. Free, open-source macOS cleaner. CleanMyMac alternative with zero telemetry. Native SwiftUI, scheduled auto-cleaning, Xcode/Homebrew/system cache cleanup. MIT licensed.

agentflow. Orchestrate thousands of agents and harnesses as a graph programatically

spec-kit. 💫 Toolkit to help you get started with Spec-Driven Development

oxo. OXO is a security scanning orchestrator for the modern age.

tailsnitch. A security auditor for Tailscale configurations. Scans your tailnet for misconfigurations, overly permissive access controls, and security best practice violations.

minimal. Minimal CVE Hardened container image collection

aws_pwn. A collection of AWS penetration testing junk

dotfiles. *NIX dot files

dnstwist. Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

DevSecOps. Ultimate DevSecOps library

nnn. n³ The unorthodox terminal file manager

BugBounty. RepoToStoreBugBountyInfo

GhidrAssistMCP. An native MCP server extension for Ghidra

mactop. mactop - Apple Silicon Monitor Top

Jarida. Jarida (Jadx + Frida) is a Jadx GUI plugin that lets you trace and optionally patch Java method return values at runtime using Frida, directly from Jadx’s decompiled view.

Malimite. iOS and macOS Decompiler

flights-mcp. An MCP server to search for flights.

pmd. An extensible multilanguage static code analyzer.

ffufai. AI-powered ffuf wrapper

GhidraMCP. MCP Server for Ghidra

screenpipe. YC (S26) | AI that knows what you've seen, said, or heard. Records everything you do, say, hear 24/7, local, private, secure. Connect to OpenClaw, Hermes agent and 100+ apps

Wordpress-Exploits. Collection of Exploit, CVES(Unauthenticated) and Wordpress Scanners

JSFScan.sh. Automation for javascript recon in bug bounty.

Bookmarks. Reclaim control of your Burp Suite Repeater tabs with this powerful extension

apk.sh. Makes reverse engineering Android apps easier, automating repetitive tasks like pulling, decoding, rebuilding and patching an APK.

yt-dlp. A feature-rich command-line audio/video downloader

Web-Cache-Vulnerability-Scanner. Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).

recaptcha-phish. Phishing with a fake reCAPTCHA

winutil. Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates

malicious-pdf. 💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh