Dwi Siswanto

apkleaks. Scanning APK file for URIs, endpoints & secrets.

awesome-oneliner-bugbounty. A collection of awesome one-liner scripts especially for bug bounty tips.

crlfuzz. A fast tool to scan CRLF vulnerability written in Go

go-dork. The fastest dork scanner written in Go.

findom-xss. A fast DOM based XSS vulnerability scanner with simplicity.

ppfuzz. A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

galer. A fast tool to fetch URLs from HTML attributes by crawl-in.

gf-secrets. Secret and/or credential patterns used for gf.

cf-check. CloudFlare Checker written in Go

go-stare. A fast & light web screenshot without headless browser but Chrome DevTools Protocol!

proxylogscan. A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).

unew. A tool for append URLs, skipping duplicates/paths & combine parameters.

slackcat. A simple way of sending messages from the CLI output to your Slack with webhook.

ngocok. ngrok Collaborator Link — yet another Burp Collaborator alternative for free with ngrok.

tlder. TLDs finder — check domain name availability across all valid top-level domains.

unch. Hides message with invisible Unicode characters

noizy. A drop-in replacement to Apple Hearing - Background Sounds with over 30+ available sounds.

wadl-dumper. Dump all available paths and/or endpoints on WADL file.

chatgptui. ChatGPT 🤖 with Textual User Interface (TUI) mode written in Go.

ipfuscator. A blazing-fast, thread-safe, straightforward and zero memory allocations tool to swiftly generate alternative IP(v4) address representations in Go.

hinject. Host Header Injection Checker

stargather. A fast GitHub stargazers information gathering tool

CVE-2025-49844. CVE-2025-49844 – Redis Lua Parser Use-After-Free

gfx. A wrapper around grep, to help you grep for things! - Improved version of gf by @tomnomnom.

bounty-targets-alert. It's an watcher for new scopes added to bounty-targets-data and send you alert to Slack.

nuclei-templates-dir. Nuclei Templates Directory

continuous-nuclei. Running nuclei Continuously

cve-2023-50164-poc. Proof of Concept for Path Traversal in Apache Struts ("CVE-2023-50164")

look4jar. Looking for JAR files that are vulnerable to Log4j RCE (CVE‐2021‐44228)?

secpat2gf. convert secret patterns to gf compatible.

cekBin. Free source to check, verify & validate BIN (Bank Identification Number), credit, debit, charge or a prepaid card.

discat. A simple way of sending messages from the CLI output to your Discord channel with webhook.

nodep. A tool for check available dependency packages across npmjs, PyPI or RubyGems registry.

leakz-passive-workflow. Caido's passive workflow to find potential leaked secrets, PII, and sensitive fields.

gD0rk. Google Hack Database dork automatic tool.

WiFiID. @wifi.id Account Extractor & Checker

BitslerBOT. Automatically Betting for Bitsler.com

delve-mcp. MCP server for Delve debugger integration

osscope. A curated GitHub repository that's in-scope and eligible for bounty.

Faucet-DOGE-Bot. Get faucet DOGE coin every minutes

huntr-hacktivity. huntr.dev public disclosures/hacktivity watcher

gollina. Follina MS-MSDT 0-day MS Office RCE (CVE-2022-30190) PoC in Go

advisory. My advisories (backlog)

ghostify-crack. A crack 💥 version of Ghostify, that helps you view Instagram stories without a trace (the story owner won't know you saw their story!)

CVE-2020-24148. CVE-2020-24148 Proof-of-Concept

xss-cheatsheet-data. This repository contains all the XSS cheatsheet data to allow contributions from the community.

offsectools_www. A vast collection of security tools.

CVE-2018-7600. PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 (Drupalgeddon 2).

awesome-search-queries. Community curated list of search queries for various products across multiple search engines.

ovaa. Oversecured Vulnerable Android App