Robin Wood

DVWA. Damn Vulnerable Web Application (DVWA)

CeWL. CeWL is a Custom Word List Generator

pipal. Pipal, THE password analyser

RSMangler. RSMangler will take a wordlist and perform various manipulations on it similar to those done by John the Ripper with a few extras.

nosqlilab. A lab for playing with NoSQL Injection

GitHunter. A tool for searching a Git repository for interesting content

authlab. A lab to play with authentication and authorisation problems

CloudStorageFinder. A collection of tools to find data that has been made public in cloud storage systems such as S3 Buckets and Digital Ocean Spaces

vuLnDAP. A vulnerable LDAP based web app written in Golang

leakyrepo. A repo which contains lots of things which it shouldn't

scanner_user_agents. A list of user agents belonging to common web scanners.

sitediff. Fingerprint a web app using local files as the fingerprint sources

twofi. Twitter Words of Interest - Generate word lists from twitter searches

svg_xss. Defending against XSS in SVG files

RSYaba. RSYaba Modular Brute Force Attacker

EyeWitness. EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

burp_collab_scripts. A set of scripts to help automate the management of Burp Collaborator

powershell_port_scanner. A port scanner written in PowerShell

pat_to_pass. Pat to Pass - Convert observed key presses to potential password lists

deleet. Take a word list and convert 1337 spellings back to normal

gin_tutorial. Learning to build web apps in Gin. Don't expect anything new or ground breaking, I'm just following tutorials.

cracked_flask. A very simple lab for cracking Flask session cookies

bearer_injection. A script to run with mitmproxy to inject a bearer token into every request.

go_practice. My practice Go files

SaveBrowsingImages. Extension for Burp to automatically save images to a file.

cachepoisoner. A lab to play with web cache poisoning

ots-cert-demo. Proof of concept code to go with my OTS Certificate blog post

typo_squatter. Suggest common typos to a given domain name which could be in use by typo squatters

theHarvester. E-mail, subdomain and people names harvester

DumbContracts. Learning and playing with Ethereum Smart Contracts

nikto. Nikto web server scanner

sockettome. A lab for security testing web sockets

nmap. Nmap - the Network Mapper. Github mirror of official SVN repository.

testssl.sh. Testing TLS/SSL encryption anywhere on any port

openapi-generator. OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec (v2, v3)

digininja. All about me!

screenshottigans. Screenshot Shenanigans

dnsrecon. DNS Enumeration Script

metasploit-framework. Metasploit Framework

the-blockchain-bar. The source-code for: "Build a Blockchain from Scratch in Go" eBook.

october_apache_test. A test for October CMS to see if Apache is setup correctly

JSONBee. A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

kb2severity. Lookup the MS severity for a given KB

thescum. This is an attempt to footprint all the trackers and profiling attempts used by numerous UK newspapers operating online, papers known for being liberal with the truth. It is a work in progress and the trackers listed here can also apply to other aspects of the web we use today.

ayfabtu. Scripts to extract files from SCM directories left on web servers

bambdas. Bambdas collection for Burp Suite Professional and Community.

sitemap2proxy. Take an XML sitemap and request all the URLs in it through your chosen proxy.

natlas. Scaling Network Scanning

CVE-2023-26258-ArcServe. Python

antfarm. Malware execution environment

go-git. A highly extensible Git implementation in pure Go.