TomNomNom

gotreesitter. Pure Go tree-sitter runtime

open-midinous. A generative meta-logic-based music software

milton. An infinite-canvas paint program

feDisplacementMaps. Playing with SVG's <feDisplacementMap>

signls. a non-linear, generative midi sequencer in the terminal :infinity:

you-get. :arrow_double_down: Dumb downloader that scrapes the web

gomponents. HTML components in pure Go.

signal-back. Decrypt Signal encrypted backups outside the app

sol. A de-minifier (formatter, exploder, beautifier) for shell one-liners

fastgron. High-performance JSON to GRON (greppable, flattened JSON) converter

ast-grep. ⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

webpaste. Save your dorking results to the terminal. A modified version of TomNomNom's amazing tool!

go-gui-projects. A list of Go GUI projects

octosql. OctoSQL is a query tool that allows you to join, analyse and transform data from multiple databases and file formats using SQL.

cortexguitarfx. guitar effects processor implemented on various arm cortex platforms

NeuralAmpModelerPlugin. Plugin for Neural Amp Modeler

spark-joy. ✨😂 2000+ ways to add design flair, user delight, and whimsy to your product.

awesome-livecoding. All things livecoding

vhs. Your CLI home video recorder 📼

ImHex. 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

lensm. Go assembly and source viewer

resolvers. The most exhaustive list of reliable DNS resolvers.

Functional-Light-JS. Pragmatic, balanced FP in JavaScript. @FLJSBook on twitter.

functional-programming-jargon. Jargon from the functional programming world in simple terms!

libbpfgo. eBPF library for Go. Powered by libbpf.

go-tree-sitter. Golang bindings for tree-sitter https://github.com/tree-sitter/tree-sitter

unzip-http. Extract individual files from .zip files over http without downloading the entire archive.

cheatsheets. Community-sourced cheatsheets

jakt. The Jakt Programming Language

quamina. Home of Quamina, a fast pattern-matching library in Go

evenmoreutils. A collection of command line tools to extend the shell environment.

dn. 💾 dn - offline full-text search and archiving for your Chromium-based browser.

jo. JSON output from a shell

fq. jq for binary formats - tool, language and decoders for working with binary and text formats

quickemu. Quickly create and run optimised Windows, macOS and Linux virtual machines

hurl. Hurl, run and test HTTP requests with plain text.

matrix. matrix (web-based green code rain, made with love)

urlhunter. a recon tool that allows searching on URLs that are exposed via shortener services

clairvoyance. Obtain GraphQL API schema even if the introspection is disabled

bcal. :1234: Bits, bytes and general-purpose calculator

gitignore. A collection of useful .gitignore templates

warcannon. High speed/Low cost CommonCrawl RegExp in Node.js

apollo. A Unix-style personal search engine and web crawler for your digital footprint.

wayback-machine-downloader. Download an entire website from the Wayback Machine.

lucky-commit. Customize your git commit hashes!

alda. A music programming language for musicians. :notes:

Ciphey. ⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

Search-That-Hash. 🔎Searches Hash APIs to crack your hash quickly🔎 If hash is not found, automatically pipes into HashCat⚡

Name-That-Hash. 🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥

hachoir. Hachoir is a Python library to view and edit a binary stream field by field

fuckitpy. The Python error steamroller.

pyWhat. 🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

page-fetch. Fetch web pages using headless Chrome, storing all fetched resources including JavaScript files. Run arbitrary JavaScript on many web pages and see the returned values

Addon. ClearURLs is an add-on based on the new WebExtensions technology and will automatically remove tracking elements from URLs to help protect your privacy.

Arjun. HTTP parameter discovery suite.

prowler. Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

leaky-paths. A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

codehike. Build rich content websites with Markdown and React

wafw00f. WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

apkleaks. Scanning APK file for URIs, endpoints & secrets.

BurpParamFlagger. A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI.

dnSpy. .NET debugger and assembly editor

BitmapFonts. My collection of bitmap fonts pulled from various demoscene archives over the years

resources. Tools, data, and contact lists relevant to The disclose.io Project.

web-ext. A command line tool to help build, run, and test web extensions

formats. File formats

vanilla-todo. A case study on viable techniques for vanilla web development.

GitDorker. A Python program to scrape secrets from GitHub through usage of a large repository of dorks.

fasthttp. Fast HTTP package for Go. Tuned for high performance. Zero memory allocations in hot paths. Up to 10x faster than net/http

gomarkov. Markov chains in golang

FavFreak. Making Favicon.ico based Recon Great again !

client-side-prototype-pollution. Prototype Pollution and useful Script Gadgets

hardware-hacking. Some stuff about Hardware Hacking

hetty. An HTTP toolkit for security research.

elsa. ❄️ Elsa is a minimal runtime for JavaScript and TypeScript written in Go

duf. Disk Usage/Free Utility - a better 'df' alternative

go-diagrams. Create beautiful system diagrams with Go

rex-gym. OpenAI Gym environments for an open-source quadruped robot (SpotMicro)

Weylus. Use your tablet as graphic tablet/touch screen on your computer.

jwt-secret. Bruteforce a JWT against a list of passwords

awesome-falsehood. 😱 Falsehoods Programmers Believe in

cloud-ranges. A list of cloud ranges from different providers.

diodb. Open-source vulnerability disclosure and bug bounty program database

SQLi-Query-Tampering. SQLi Query Tampering extends and adds custom Payload Generator/Processor in Burp Suite's Intruder. This extension gives you the flexibility of manual testing with many powerful evasion techniques.

TLS-poison. Rust

macintosh.js. 🖥 A virtual Apple Macintosh with System 8, running in Electron. I'm sorry.

NoiseTorch. Real-time microphone noise suppression on Linux.

weird_proxies. Reverse proxies cheatsheet

urlgrab. A golang utility to spider through a website searching for additional links.

Pwdb-Public. A collection of all the data i could extract from 1 billion leaked credentials from internet.

promnesia. Another piece of your extended mind

gitscraper. A tool which scrapes public github repositories for common naming conventions in variables, folders and files

asm. assembly language examples, mostly Linux

OneForAll. OneForAll是一款功能强大的子域收集工具

go-arg. Struct-based argument parsing in Go

burp-piper. Piper Burp Suite Extender plugin

katana. Katana - Automatic CTF Challenge Solver in Python3

ctf-katana. This repository aims to hold suggestions (and hopefully/eventually code) for CTF challenges. The "project" is nicknamed Katana.

dell-xps-9570-ubuntu-respin. Collection of scripts and tweaks to adapt Ubuntu running smooth on Dell XPS 15 9570.

xss-cheatsheet-data. This repository contains all the XSS cheatsheet data to allow contributions from the community.

dnsvalidator. Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.

services-names-wordlist. services-names-wordlist

goawk. A POSIX-compliant AWK interpreter written in Go, with CSV support

ApplicationInspector. A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.

bruteforce-lists. Some files for bruteforcing certain things.

pipedream. Connect APIs, remarkably fast. Free for developers.

the-book-of-secret-knowledge. A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

git-secrets. Prevents you from committing secrets and credentials into git repositories

jwtcat. A CPU-based JSON Web Token (JWT) cracker and - to some extent - scanner.

reredirect. Tool to dynamicly redirect outputs of a running process

Awesome-Hacking. A collection of various awesome lists for hackers, pentesters and security researchers

andriller. 📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

huginn. Create agents that monitor and act on your behalf. Your agents are standing by!

uni. Query the Unicode database from the commandline, with good support for emojis

sherlock. Hunt down social media accounts by username across social networks

hacker-laws. 🧠 Laws, Theories, Principles and Patterns for developers and technologists.

Sourcetrail. Sourcetrail - free and open-source interactive source explorer

awesome-osint. :scream: A curated list of amazingly awesome OSINT

codesearch. Fast, indexed regexp search over large file trees

detect-secrets. An enterprise friendly way of detecting and preventing secrets in code.

GitHunter. A tool for searching a Git repository for interesting content

brozzler. brozzler - distributed browser-based web crawler

SandDance. Visually explore, understand, and present your data.

domdig. DOM XSS scanner for Single Page Applications

inql. InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

n8n. Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

Jailer. Database Subsetting and Relational Data Browsing Tool.

eyeballer. Convolutional neural network for analyzing pentest screenshots

dnsgen. DNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration testers. It generates intelligent domain name variations to assist in subdomain discovery and security assessments.

strings. Strings is a custom, Unicode-competent version of the BSD strings utility.

xurls. Extract urls from text

pwntools. CTF framework and exploit development library

shhgit. Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.

pentest-tools. A collection of custom security tools for quick needs.

awesome-chrome-devtools. Awesome tooling and resources in the Chrome DevTools & DevTools Protocol ecosystem

chromedp. A faster, simpler way to drive browsers supporting the Chrome DevTools Protocol.

gitGraber. gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

Awesome-Asset-Discovery. List of Awesome Asset Discovery Resources

awesome-actions. A curated list of awesome actions to use on GitHub

statistically-likely-usernames. Wordlists for creating statistically likely username lists for use in password attacks and security testing. Used for pentesting for over 10 years with amazing results.

my-arsenal-of-aws-security-tools. List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

httpninja. HTTP.ninja

pigo. Fast face detection, pupil/eyes localization and facial landmark points detection library in pure Go.

skopeo. Work with remote images registries - retrieving information, images, signing content

pup. Parsing HTML at the command line

htq. A grep-like tool for extracting elements from html using CSS Selectors

xxhash. A Go implementation of the 64-bit xxHash algorithm (XXH64)

connect. Fancy stream processing made operationally mundane

VHostScan. A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

SundayStreams. Data from my Sunday streams

otxurls. Fetch known urls from AlienVault's Open Threat Exchange for given hosts

dive. A tool for exploring each layer in a docker image

zalenium. A flexible and scalable container based Selenium Grid with video recording, live preview, basic auth & dashboard.

curl-to-go. Convert curl commands to Go code in your browser

recursebuster. rapid content discovery tool for recursively querying webservers, handy in pentesting and web application assessments

ripgrep-all. rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.

url-knife. Extract and decompose (fuzzy) URLs (including emails, which are conceptually a part of URLs) in texts with Area-Pattern-based modularity

badwolf. Temporal graph store abstraction layer.

ArchiveSpark. An Apache Spark framework for easy data processing, extraction as well as derivation for web archives and archival collections, developed at Internet Archive.

semantic. Parsing, analyzing, and comparing source code across many languages

TravisLeaks. A tool to find sensitive keys and passwords in Travis logs

keywords.

JSONBee. A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

Scout2. Security auditing tool for AWS environments

chroma-code. Chroma key in your browser!

chrome-names. Periodically updated lists of interesting Chrome (blink) "names".

keyhacks. Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

SlackPirate. Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace

find-sec-bugs. The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

50M_CTF_Writeup. $50 Million CTF from Hackerone - Writeup

intrigue-ident. Application and Service Fingerprinting

get_schemas. Print out URL schemas from an Android app

upload-scanner. HTTP file upload scanner for Burp Proxy

grofs. Simple Git Read-Only File System

brakeman. A static analysis security vulnerability scanner for Ruby on Rails applications

PentestHardware. Kinda useful notes collated together publicly

osquery. SQL powered operating system instrumentation, monitoring, and analytics.

gitbase. SQL interface to git repositories, written in Go. https://docs.sourced.tech/gitbase

go-mysql-server. An extensible MySQL server implementation in Go.

hash_extender. C

darktile. :waning_crescent_moon: Darktile is an experimental/abandoned GPU rendered terminal emulator designed for tiling window managers.

off-by-slash. Burp extension to detect alias traversal via NGINX misconfiguration at scale.

phpggc. PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

api-playground. The Best Buy API Playground is an API training tool for students, educators and other learners to explore the possibilities of a fully functional RESTful API in a simple, non-production environment.

hyperscan. High-performance regular expression matching library

fdns. Concurrent Rapid7 FDNS dataset parser

burp-extender-api-kotlin. Burp Extender API - Unofficial Kotlin version

Open-Redirect-Payloads. Open Redirect Payloads

pure-bash-bible. 📖 A collection of pure bash alternatives to external processes.

bucket-stream. Find interesting Amazon S3 Buckets by watching certificate transparency logs.

dnscache. A DNS Cache for Go

PadBuster. Automated script for performing Padding Oracle attacks

websocat. Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions

altdns. Generates permutations, alterations and mutations of subdomains and then resolves them

pathbrute. Pathbrute

wayback. IA's public Wayback Machine (moved from SourceForge)

BurpSuiteHTTPSmuggler. A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques

Hackfest2017-Challenges. All of my Hackfest 2017 CTF challenges

public-cloud-storage-search. A search engine for content shared publicly via cloud storage services

termtosvg. Record terminal sessions as SVG animations