OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.

Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wis…

Arduino command line tool

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

📦 Make security testing of K8s, Docker, and Containerd easier.

Fetch all the URLs that the Wayback Machine knows about for a domain

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

An OOB interaction gathering server and client library

Go assembly and source viewer

Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy

🔓 🔓 Find secrets and passwords in container images and file systems 🔓 🔓

a drop-in replacement for Nmap powered by shodan.io

A tool to perform Kerberos pre-auth bruteforcing

Contextual Content Discovery Tool

Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Ku…

A versatile and portable proxy for capturing, manipulating, and replaying HTTP/HTTPS traffic on the go.

ScareCrow - Payload creation framework designed around EDR bypass.

Quickly discover exposed hosts on the internet using multiple search engines.

🔥 CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems.

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.

A very small, very simple, yet very secure encryption tool.

Adversary tradecraft detection, protection, and hunting

Bruteforcing from various scanner output - Automatically attempts default creds on found services.

A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster

Automating situational awareness for cloud penetration tests.

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

A static analysis tool for securing Go code

Declarative configuration for Gmail filters

Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?

Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.