Lists (5)
Stars
Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX entrypoints). Detects SQLi, XSS, IDOR, privesc, RCE. Buil…
Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
PostScript examples useful for attacking Ghostscript.
Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions
A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.
Deobfuscate obfuscator.io, unminify and unpack bundled javascript
MassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy input-output support.
HackerOne资产更新 | 每日更新HackerOne资产，对HackerOne的资产进行爬行和整理，SRC资产更新仅会增加，不会进行删除，每天更新的可以进行差异化对比来获取到新的项目资产范围
A tool to compare two APK files at the dex level. Useful for checking the impact of things like fullMode and dex optimisations.
Frida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic
NeXSS is a modern, self-hosted Blind XSS (Cross-Site Scripting) hunter and callback listener built with Next.js. It helps security researchers and penetration testers discover and validate blind XS…
Unified datasets for public cloud provider IP ranges. Providers include AWS, Azure, CloudFlare, DigitalOcean, Fastly, Google Cloud and Oracle Cloud.
An up-to-date export of cloud provider IP address ranges
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
Empty project to quick start Proof of Concept app development
🔓A Curated List Of Modern Android Exploitation Conference Talks
Python-based static analyzer for Android APKs that extracts attack surface and flags high-risk vulnerability patterns with lightweight taint heuristics.
Repo containing reports and PoCs for a selection of vulnerabilities I have discovered and that have been assigned a CVE identifier.
A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
An MCP Server for Chrome DevTools, following the Chrome DevTools Protocol. Integrates with Claude Desktop and Claude Code.
Plugin for JADX to integrate MCP server
A tool for reverse engineering Android apk files
Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store