Satoshi Tajima

openclaw. Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

moltworker. Run OpenClaw, (formerly Moltbot, formerly Clawdbot) on Cloudflare Workers

openwork. TypeScript

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

gocontracts. A tool for design-by-contract in Go

OpenHands. 🙌 OpenHands: AI-Driven Development

vncdotool. A command line VNC client and python library

awesome-fintech. A curated collection of open source fintech libraries and resources.

tls-scan. An Internet scale, blazing fast SSL/TLS scanner ( non-blocking, event-driven )

salesforce-security-review-automation. Salesforce Security Review Automation via Playwright

cloudsplaining. Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

orgu. orgu is a tool for implementing organization-wide workflows on GitHub

apkleaks. Scanning APK file for URIs, endpoints & secrets.

gau. Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

sslscan. sslscan tests SSL/TLS enabled services to discover supported cipher suites

gobuster. Directory/File, DNS and VHost busting tool written in Go

graudit. grep rough audit - source code auditing tool

ffuf. Fast web fuzzer written in Go

WhatWeb. Next generation web scanner

gitleaks. Find secrets with Gitleaks 🔑

lapper. Lapper is a wrapper programs for Container running on Lambda. (Beta)

gorilla. Gorilla: Training and Evaluating LLMs for Function Calls (Tool Calls)

PentestGPT. Automated Penetration Testing Agentic Framework Powered by Large Language Models

dnsx. dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.

tabby. Self-hosted AI coding assistant

flan. A pretty sweet vulnerability scanner

haystack. Open-source AI orchestration framework for building context-engineered, production-ready LLM applications. Design modular pipelines and agent workflows with explicit control over retrieval, routing, memory, and generation. Built for scalable agents, RAG, multimodal applications, semantic search, and conversational systems.

openplayground. An LLM playground you can run on your laptop

offensive-ai-compilation. A curated list of useful resources that cover Offensive AI.

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

dmarc-email-worker. DMARC reports processor using Cloudflare Workers and Email Workers

hono. Web framework built on Web Standards

cloudflare-worker-router. A super lightweight router (1.0K) with middleware support and ZERO dependencies for Cloudflare Workers.

itty-router. A little router.

alpaca-lora. Instruct-tune LLaMA on consumer hardware

alpaca.cpp. Locally run an Instruction-Tuned Chat-Style LLM

guardrails. Adding guardrails to large language models.

llama_index. LlamaIndex is the leading document agent and OCR platform

langchain. The agent engineering platform.

langchain-hub. Python

llama. Inference code for Llama models

CloudFlair. 🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

belldog. Manage and proxy Slack webhooks

scep. Go SCEP server

cartography. Cartography is a Python tool that pulls infrastructure assets and their relationships into a Neo4j graph database.

mobsfscan. mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

BlueHound. BlueHound - pinpoint the security issues that actually matter

cloud-middleware-dataset.

sliver. Adversary Emulation Framework

BananaPhone. It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)

go-mimikatz. A wrapper around a pre-compiled version of the Mimikatz executable for the purpose of anti-virus evasion.

ratnet. Ratnet is a prototype anonymity network for mesh routing and embedded scenarios.

blackbird. An OSINT tool to search for accounts by username and email in social networks.

reFlutter. Flutter Reverse Engineering Framework

SambaHunter. It is a simple script to exploit RCE for Samba (CVE-2017-7494 ).

zerologon. Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB

iodine. Official git repo for iodine dns tunnel

chisel. A fast TCP/UDP tunnel over HTTP

hayabusa. Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

marshalsec. Java

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

insider. Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

UTM. Virtual machines for iOS and macOS

tudo. TUDO — A Vulnerable PHP Web App

go-msgraph. Golang implementation of the Microsoft Graph API

all-the-package-names. 🔤 A list of all the public package names on npm. Updated daily.

petereport. PeTeReport is an open-source application vulnerability reporting tool.

go_tpm_https_embed. TPM based mTLS

grr. GRR Rapid Response: remote live forensics for incident response

3proxy. 3proxy - tiny free proxy server

ProjectChampollion. Reverse engineering Rosetta 2 on M1 Mac

wpscan. WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

JavaWebApplicationStepByStep. JSP Servlets Tutorial For Beginners - in 25 Steps

NodeJS-Sample-App. Sample Employee CRUD application with Node.js, Express and MongoDB

simple-web-app-mvc-dotnet. Simple Web App MVC (C#, ASP.NET 9.0, MVC, Entity Framework ORM, Identity)

simple-php-website. An introductory example of how to build a simple and minimal website built with PHP.

bruteforce-luks. Try to find the password of a LUKS encrypted volume.

macos_security. macOS Security Compliance Project

CIS-Script. Shell

RIP.

EventTranscript.db-Research. A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

apprunner-roadmap. This is the public roadmap for AWS App Runner.

grafana. The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

canarytokens. Canarytokens helps track activity and actions on your network

tcardgen. Generate a TwitterCard(OGP) image for your Hugo posts.

zerologon. Exploit for zerologon cve-2020-1472

OSCP-Exam-Report-Template. Modified template for the OSCP Exam and Labs. Used during my passing attempt

feroxbuster. A fast, simple, recursive content discovery tool written in Rust.

OSCP-PWK-Repo. The stuff I gathered during my time at the PWK labs and my OSCP exam.

OSCP. Materials for OSCP exam

JAWS. JAWS - Just Another Windows (Enum) Script

php-reverse-shell. PHP

OSCP-BoF. This is a walkthrough about understanding the #BoF machine present in the #OSCP exam.

dotdotpwn. DotDotPwn - The Directory Traversal Fuzzer

CVE-2017-12617. Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution

webauthn-example. Basic WebAuthn client and server in go

Symlink-Directory-Traversal-smb-manually. SAMBA Symlink Directory Traversal Manual Exploitation

Sherlock. PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

lambda-query. A serverless DB querying client with Lambda

crowbar. Crowbar is brute forcing tool that can be used during penetration tests. It is developed to support protocols that are not currently supported by thc-hydra and other popular brute forcing tools.

PowerShell-Suite. My musings with PowerShell

UACME. Defeating Windows User Account Control

Juicy-Potato-x86. Juicy Potato for x86 Windows

windows-privesc-check. Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems

wesng. Windows Exploit Suggester - Next Generation

nasmshell. shell for nasm

ctfpwn_challenge. C

GTFOBins.github.io. GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

pyroscope. Continuous Profiling Platform. Debug performance issues down to a single line of code

HackingAllTheThings. My documentation and tools for learn ethical hacking.

juicy-potato. A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.

Perfusion. Exploit for the RpcEptMapper registry key permissions vulnerability (Windows 7 / 2088R2 / 8 / 2012)

hashID. Software to identify the different types of hashes -

odat. ODAT: Oracle Database Attacking Tool

WhatWaf. Detect and bypass web application firewalls and protection systems

impacket. Impacket is a collection of Python classes for working with network protocols.

jwt_tool. :snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

Hob0Rules. Password cracking rules for Hashcat based on statistics and industry patterns

OSCP-Exam-Report-Template-Markdown. :orange_book: Markdown Templates for Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP exam report

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

PEASS-ng. PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

red_team_tool_countermeasures. YARA

aws-lambda-base-images.

aws-lambda-runtime-interface-emulator. Go

MY_CHEAT_SHEET. cheat sheet for penetration testing (Japanese) 🐉

local-exploits. Various local exploits

SirepRAT. Remote Command Execution as SYSTEM on Windows IoT Core (releases available for Python2.7 & Python3)

Cloak. A censorship circumvention tool to evade detection by authoritarian state adversaries

gophish. Open-Source Phishing Toolkit

kemon. An Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.

oletools. oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

confidential-computing-modules. A Module for Privacy-preserving State Transitions with Verifiability

conftest. Write tests against structured configuration data using the Open Policy Agent Rego query language

artwork. OCI artwork and logos

enry. A faster file programming language detector

GAM. command line management for Google Workspace

diagrams. :art: Diagram as Code for prototyping cloud system architectures

gosec. Go security checker

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

atlantis. Terraform Pull Request Automation

SSRFTest. SSRF testing tool

rules. Repository of yara rules

modwifi. Shell

Microwalk. A microarchitectural leakage detection framework using dynamic instrumentation.

oss-fuzz. OSS-Fuzz - continuous fuzzing for open source software.

pcapfex. 'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

tplmap. Server-Side Template Injection and Code Injection Detection and Exploitation Tool

Mythic. A collaborative, multi-platform, red teaming framework

drozer. The Leading Security Assessment Framework for Android.

CyBot. Open Source Threat Intelligence Chat Bot

wig-ng. WIG (WiFi Information Gathering) is a free and open source utility for WiFi device fingerprinting.

WIG. Tools for 802.11 information gathering.

acsploit. A tool for generating worst-case inputs to commonly used algorithms

zxcvbn. Low-Budget Password Strength Estimation

LetsMapYourNetwork. Lets Map Your Network enables you to visualise your physical network in form of graph with zero manual error

chocoProxy. C#

zigdiggity. A ZigBee hacking toolkit by Bishop Fox

tainted_love. Dynamic Security Analysis for Ruby

ScoutSuite. Multi-Cloud Security Auditing Tool

kube-hunter. Hunt for security weaknesses in Kubernetes clusters

shadow-workers. Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW)

AttackSurfaceAnalyzer. Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.

Lauschgeraet. Gets in the way of your victim's traffic and out of yours

mitmengine. A MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:

apple_bleee. Apple BLE research

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

developer-roadmap. Interactive roadmaps, guides and other educational content to help developers grow in their careers.

system-design-primer. Learn how to design large-scale systems. Prep for the system design interview. Includes Anki flashcards.

mdx-deck. ♠️ React MDX-based presentation decks

sshpry. Seamlessly spy on SSH session like it is your tty

deep-learning-from-scratch. 『ゼロから作る Deep Learning』(O'Reilly Japan, 2016)

phpdcd. Dead Code Detector (DCD) for PHP code.

hyperd. HyperContainer Daemon

lepton. Lepton is a tool and file format for losslessly compressing JPEGs by an average of 22%.

vegeta. HTTP load testing tool and library. It's over 9000!

vuls. Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

netdata. The fastest path to AI-powered full stack observability, even for lean teams.

awsecrets. AWS credentials loader

awspec. RSpec tests for your AWS resources.

mod_rpaf-0.6. C

GoogleCodeJam_PHP. PHP

MY-CODEIGNITER. edited codeigniter

jquery-pjax. pushState + ajax = pjax

MY-RCFILES. rcfiles

PAC-MAN-GDD2010. GDD 2010 Dev Quiz

vim-surround. surround.vim: Delete/change/add parentheses/quotes/XML-tags/much more with ease