MOHAMMAD SAQLAIN

js-recon. Automate JS analysis on modern JS apps

.context. AI Agent Skills for Security Auditing to generate triaged, industry grade report findings, code locations, pocs, attacker story flow graphs and more

directus. The flexible backend for all your projects 🐰 Turn your DB into a headless CMS, admin panels, or apps with a custom UI, instant APIs, auth & more.

floci. Light, fluffy, and always free - The AWS Local Emulator alternative

scalpel. Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts.

tailpos. TailPOS an Offline First Open Source POS for ERPNext

invoify. An invoice generator app built using Next.js, Typescript, and Shadcn

Invitation-Flow-Security-Testing-Checklist. checklist for testing invitation / team-member invite flows for business-logic vulnerabilities. Use this as a GitHub-ready checklist in your repo, penetration-testing notes, or bug bounty writeups. Each item includes: What to test → Quick test steps → PoC / Request template → Expected (bad) behavior → Impact → Mitigation.

claude-code-security-review. An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

webappanalyzer. This project aims to maintain Wappalyzer technologies

openhare. AI-powered desktop SQL client. Cross-platform. Built with Flutter.

Claude-OSINT. Two paired Claude skills · 90+ recon modules · 48 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · 5,500+ lines of structured tradecraft. Drop-in SKILL.md files that turn Claude into a god-mode external recon operator for authorized red-team and bug-bounty engagements.

Proteus. Proteus is a plugin for Claude Code, Codex and Opencode, plus a local runtime, for structured, continuous vulnerability research.

authz-replay. Replay any request as another user to find IDOR/BOLA/BFLA, right in the browser.

claude-bug-bounty. AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.

tcpk. Portable Windows toolkit for pentesting thick-client applications, including .NET, MSIX, and native binaries.

repshot. RepShot · Generate professional security finding cards directly from Burp Suite Repeater.

MacroFlow. MacroFlow is a visual, node-based macro workflow engine for Burp Suite. It replaces Burp's built-in Macro system with a drag-and-drop canvas where you build multi-step HTTP flows, automatically inject session tokens, and validate reflected payloads across multiple targets - all without writing a single script.

damn-vulnerable-ai-agent. Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.

iris. Intent Runtime Inspection System

tarnish. A Chrome extension static analysis tool to help aide in security reviews.

invisible_playwright. Anti-Detect Browser that passes every bot detection test. Drop-in Playwright replacement.

src-hunter-skill. 实战 SRC / 众测 / Bug bounty 漏洞挖掘 Claude Code skill — 19 个攻击类 playbook、305 个结构化 payload、263 个 WAF/EDR 绕过、2887 份 HackerOne 真实案例、88,636 WooYun 案例统计

android-reverse-engineering-skill. Claude Code skill to support Android app's reverse engineering

cal.diy. Scheduling infrastructure for absolutely everyone.

Mind-Map. 各种安全相关思维导图整理收集

swagger-hack. 自动化爬取并自动测试所有swagger接口

Invio. Self-hosted invoicing without the bloat.

shopware. Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 3.100 community extensions

nullhyd-org. CSS

simplesamlphp. SimpleSAMLphp is an application written in native PHP that deals with authentication.

frida-script-gen. Generate Frida bypass scripts for Android APK root and SSL checks.

viewstate-security-workshop. This repository is for the Testing ASP.NET ViewState with YSoNet (YSoSerial.NET) workshop.

JavaID. java source code static code analysis and danger function identify prog

humanify. Deobfuscate Javascript code using ChatGPT

restringer. A Javascript Deobfuscator

webcrack. Deobfuscate obfuscator.io, unminify and unpack bundled javascript

evilarc. Create tar/zip archives that can exploit directory traversal vulnerabilities

git-city. Your GitHub profile as a 3D pixel art building in an interactive city

ctf-skills. Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more

EasyAdminBundle. EasyAdmin is a fast, beautiful and modern admin generator for Symfony applications.

fridare. 强大的 Frida 重打包工具，用于 iOS 和 Android。轻松修改 Frida 特征，增强隐蔽性，绕过检测。简化逆向工程和安全测试。Powerful Frida repackaging tool for iOS and Android. Easily modify Frida servers to enhance stealth and bypass detection. Streamlines reverse engineering and security testing.

CodeVisualizer. CodeVisualizer is a powerful VS Code extension that provides two main visualization capabilities: function-level flowcharts for understanding code control flow, and codebase-level dependency graphs for analyzing project structure and module relationships.

ast-flow-graph. Creates a CFG from JavaScript source code.

codeflow. Paste any GitHub URL → interactive architecture map. See how files connect, find what breaks if you change something. No install, no accounts — runs entirely in your browser.

VibeSec-Skill. This skill helps Claude write secure code and prevent common vulnerabilities.

heisenberg-ssc-health-check. Analyzes software dependencies across GitHub repositories to identify security vulnerabilities and health risks in your supply chain.

bearer. Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

gradio. Build and share delightful machine learning apps, all in Python. 🌟 Star to support our work!

agents. Build and deploy AI Agents on Cloudflare

idno. A social publishing platform.

dtd-finder. List DTDs and generate XXE payloads using those local DTDs.

white-box-challenges. JavaScript

react-cosmos. Sandbox for developing and testing UI components in isolation

openemr. The most popular open source electronic health records and medical practice management solution.

kubernetes-the-hard-way. Bootstrap Kubernetes the hard way. No scripts.

firecrawl. The API to search, scrape, and interact with the web at scale. 🔥

vscode-security-notes. Create notes during a security code review in VSCode 📝 Import your favorite SAST tool findings 🛠️ and collaborate with others 🤝

cli. The official CLI for interacting with your Doppler secrets and configuration.

skills. Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

yaak. The most intuitive desktop API client. Organize and execute REST, GraphQL, WebSockets, Server Sent Events, and gRPC 🦬

Burp-MCP-Assistant. Burp Suite MCP Assistant in IDE Extension

wtfis. Passive hostname, domain and IP lookup tool for non-robots

dive. A tool for exploring each layer in a docker image

sqlit. A user friendly TUI for SQL databases. Written in python. Supports SQL server, Mysql, PostreSQL, SQLite, Turso and more.

witr. Why is this running?

dockerscan. The Most Comprehensive Docker Security Scanner

curlconverter. Transpile curl commands into Python, JavaScript and 27 other languages

Recaf. The modern Java bytecode editor

rep-chrome. rep+ — Burp-style HTTP Repeater for Chrome DevTools with built‑in AI to explain requests and suggest attacks

Fastjson-Gadgets-Automatic-Scanner. Automatically scan jar packages by using ast to find fastjson gadgets. In particular, this project is limited to mining Gadgets that may be exploited, and screening results need to be excluded by themselves. Looking forward to Fork and Star.

Security-Learning. 对于安全学习的一些总结，更新ing，期待 Fork & Star！

request-catcher. Capture HTTP requests with ease! Create a private bucket, capture requests, and analyze the results. Useful for security and E2E testing.

ct-archive. A directory of archived Certificate Transparency (CT) logs and tools to archive RFC 6962 and Static CT logs.

android-penetration-testing-cheat-sheet. Work in progress...

ios-penetration-testing-cheat-sheet. Work in progress...

autoswagger. Autoswagger by Intruder - detect API auth weaknesses

awesome-reverse-engineering. Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos)

Fresh-Resolvers. List of Hourly Updated Fresh DNS resolvers

TunProxy. Android VPN interceptor to send HTTP and HTTPS traffic to a proxy

Awesome-Fuzzing. A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.

jsxtract. JSXtract is a security research tool used to pull various type of data from JS files that exist within a selected tab.

hack_tips.

IP-Obfuscator. Simple script to convert and obscure any IP address of any host.

jwt-vulnerabilities-lab. JavaScript

BurpSuite_LocalAI. Java

vulnhuntr. Zero shot vulnerability discovery using LLMs

vuln-bank. A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn pentesting and secure coding practices.

vulhub. Pre-Built Vulnerable Environments Based on Docker-Compose

xss-waf-bypass. XSS Payloads for WAF Bypass

codesearch. Fast, indexed regexp search over large file trees

myDrive. Node.js and mongoDB Google Drive Clone

tinyauth. The tiniest OpenID Certified™ authorization and authentication server you have ever seen.

killbill. Open-Source Subscription Billing & Payments Platform

SolidInvoice. Simple and elegant invoicing solution.

resume. ATS-Friendly Markdown-to-PDF Resume Generator

vulnerable-code-snippets. Twitter vulnerable snippets

Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes. A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.

Talks. My talks...

zin-mcp-client. MCP Client which serves as bridge between mcp servers and local LLMs running on Ollama, Created for MCP Servers Developed by Me, However other MCP Servers may run as well

leaked-system-prompts. Collection of leaked system prompts

EasyEASM. Zero-dollar attack surface management tool

apkleaks. Scanning APK file for URIs, endpoints & secrets.

ipfuscator. A blazing-fast, thread-safe, straightforward and zero memory allocations tool to swiftly generate alternative IP(v4) address representations in Go.

CF-Hero. CF-Hero is a reconnaissance tool that uses multiple data sources to discover the origin IP addresses of Cloudflare-protected web applications

opengrep. 🔎 Static code analysis engine to find security issues in code.

eventlistener-xss-recon.

AI-Red-Teaming-Playground-Labs. AI Red Teaming playground labs to run AI Red Teaming trainings including infrastructure.

newtowner. Abuse trust-boundaries to bypass firewalls and network controls

formatify. Formatify is a Burp Suite extension that instantly converts HTTP requests into multiple formats like cURL, Python, PowerShell, and more—saving time and streamlining your workflow. 🚀

sectracker. A Modern Bug Bounty and Security Research Management Platform

system_prompts_leaks. Extracted system prompts from Anthropic - Claude Fable 5, Opus 4.8, Claude Code, Claude Design. OpenAI - ChatGPT GPT-5.6, Codex GPT-5.6, GPT-5.5. Google - Gemini 3.5 Flash, 3.1 Pro, Antigravity. xAI - Grok, Cursor, Copilot, VS Code, Perplexity, and more. Updated regularly.

Vulnerable-JWT. Collection of vulnerable APIs/apps to test JWT attacks

ctf-archives. CTF Archives: Collection of CTF Challenges.

lightyear. lightyear is a tool to dump files in tedious (blind) conditions using PHP filters

jxscout. jxscout superpowers JavaScript analysis for security researchers

XORpass. Encoder to bypass WAF filters using XOR operations.

jwt-cracker-go. jwt-cracker-go is a simple brute force cracker for HS256, HS384, and HS512 JWT tokens, inspired by jwt-cracker.

js-analysis-tools. A collection of js analysis tools & scripts.

github-dorks. The repository contains useful GitHub dorks for finding open-source vulnerabilities.

ua-shuffler. A chrome extension that lets you specify request headers with a list of values that are randomly "shuffled" trough on every request.

DataExtractor. A Burp Suite extension to extract datas from source code while browsing.

graphqlextractor. Extract GraphQL operations from javascript

burpference. A research project to add some brrrrrr to Burp

web-testing-bookmarklets. This is a set of bookmarklets I use for analyzing web applications for testing purposes.

jq_cookbook. Here are my favorite JQ scripts for analysis and web-based testing.

Poc. PoC collection of Atlassian(Jira, Confluence, Bitbucket) products and Jenkins, Solr, Nexus

frida-scripts. A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.

bbmon. web app monitoring automation

prompts.chat. f.k.a. Awesome ChatGPT Prompts. Share, discover, and collect prompts from the community. Free and open source — self-host for your organization with complete privacy.

browser-use. 🌐 Make websites accessible for AI agents. Automate tasks online with ease.

ideviceinstaller. Manage apps of iOS devices

dock-droid. Docker Android - Run QEMU Android in a Docker! X11 Forwarding! CI/CD for Android!

template-injection-playground. The Template Injection Playground allows to test a large number of the most relevant template engines for template injection possibilities.

template-injection-table. The Template Injection Table is intended to help during the testing of an application for template injection vulnerabilities.

AssetsTools.NET. Read and write unity assets/bundle files, based on https://github.com/SeriousCache/UABE

awesome-secure-code-review.

Web-CTF-Cheatsheet. Web CTF CheatSheet 🐈

security-code-review. My personal collection of resources (mostly tools and training materials) for source code security audits.

manual-source-code-review. Regex patterns for manual application source code review

Secure-Code-Review-Snippets. Welcome to the secure code review snippets for secure code review snippets! This repository aims to provide developers with valuable examples and guidance for conducting secure code reviews and writing secure code.

CSPTBurpExtension. CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.

clairvoyance. Obtain GraphQL API schema even if the introspection is disabled

unpack-burp. For unpacking base64:ed "Save items"-content from Burp (From search + proxy history)

Postman-Pat. Burp extension to import Postman collections and create Repeater tabs

restfire. A lightweight web-based Postman alternative for testing your APIs

PentestOAuthServer. Kotlin

bypass-url-parser. bypass-url-parser

mapperplus. MapperPlus facilitates the extraction of source code from a collection of targets that have publicly exposed .js.map files.

test-proxy. Advanced test for proxy & waf

csvtk. A cross-platform, efficient and practical CSV/TSV toolkit in Golang

rush. A cross-platform command-line tool for executing jobs in parallel

FriList. Collection of useful FRIDA Mobile Scripts

awesome-bugbounty-tools. A curated list of various bug bounty tools

semgrep-rules. My custom semgrep rules

gf-patterns. A repository of some useful grep patterns for tomnomnoms gf tool

BurpMontoyaRetryRequests. Kotlin

MontoyaEveryParameter. Kotlin

DevSecOps. ♾️ Collection of DevSecOps Notes + Resources + Courses + Tools

graphql-cop. Security Auditor Utility for GraphQL APIs

chunkloader. A chrome/Firefox extension to retrieve and load react javascript chunks all at once for a wide range of javascript techs

Android-iOS-Cheat-Sheet.

ARTHookScripts. frida runtime resolves smali

graudit. grep rough audit - source code auditing tool

subdomain-monitoring-elasticsearch. Go

GQLSpection. GQLSpection - parses GraphQL introspection schema and generates possible queries

medusa. Mobile Edge-Dynamic Unified Security Analysis

baddns. Check subdomains for subdomain takeovers and other DNS tomfoolery

inql. InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

Fabric. Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.

nowafpls. Burp Plugin to Bypass WAFs through the insertion of Junk Data

httpc. HTTP Client Library for security tooling

jsoncrack.com. ✨ Innovative and open-source visualization application that transforms various data formats, such as JSON, YAML, XML and CSV into interactive graphs.

csprecon. Discover new target domains using Content Security Policy

gungnir. CT Log Scanner

linux-exploit-suggester. Linux privilege escalation auditing tool

postleaks. Search for sensitive data in Postman public library.

http-garden. Differential testing framework for HTTP implementations

bbscope. Scope aggregation tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!

get-all-parameters. Burp Extension to find potential endpoints, parameters, and generate a custom target wordlist

postMessage-tracker-firefox. A Firefox Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon

Frida-Labs. The repo contains a series of challenges for learning Frida for Android Exploitation.

wafer. Python

dnsgen. DNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration testers. It generates intelligent domain name variations to assist in subdomain discovery and security assessments.

curated-semgrep-rules. Curated Collection of Popular Community Rules for Semgrep

frida-android-helper. Frida Android utilities

JS-Tap. JavaScript beacons and C2 to be used for XSS payload or post exploitation implants on webapp servers or desktop software to monitor users and maintain persistence. Browser extension, electron app, and node/bun app implants are included.

kenzer. automated web assets enumeration & scanning [DEPRECATED]

sj. A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

sus_params. Python

UUIDHunter. This Extension provides a Passive and Active Scan Check that detects V1 UUIDs and attempts to find other potentially valid ones.

RepeaterSearch. This extension adds a search bar to the Repeater tab that can be used to highlight all repeater tabs where the request and/or response matches a query via simple text matching or Regex.

BurpSuite-Team-Extension. This Burpsuite plugin allows for multiple web app testers to share their proxy history with each other in real time. Requests that comes through your Burpsuite instance will be replicated in the history of the other testers and vice-versa!

jaeles. The Swiss Army knife for automated Web Application Testing

github-stargazer. View stars evolution of GitHub repositories.

Nope-Proxy. TCP/UDP Non-HTTP Proxy Extension (NoPE) for Burp Suite.

rmm. Recon MindMap (RMM)

XSpear. 🔱 Powerfull XSS Scanning and Parameter analysis tool&gem

poc_subto. JavaScript

skanuvaty. Dangerously fast DNS/network/port scanner