dphuxley

such-static-analysis

Source code scanner. Scan a Java codebase for instances of SQL injection, or print out how many lines of code are in each file.

js-fuzz

An AFL-inspired genetic fuzz tester for JavaScript

framboise

Framboise is a fuzzer for in-depth testing of WebAPIs.

octo

A fuzzing library in JavaScript. ✨

steady

Analyses your Java applications for open-source dependencies with known vulnerabilities, using both static analysis and testing to determine code context and usage for greater accuracy. https://eclipse.github.io/steady/

spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

funfuzz

A collection of fuzzers in a harness for testing the SpiderMonkey JavaScript engine.

hardentools

Hardentools simply reduces the attack surface on Microsoft Windows computers by disabling low-hanging fruit risky features.

bucket-stream

Find interesting Amazon S3 Buckets by watching certificate transparency logs.

S3Scanner

Scan for misconfigured S3 buckets across S3-compatible APIs!

Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Python-FTP-Fuzzer

Python FTP Fuzzer and Ability FTP Server POC

Pentesting

Tricks for penetration testing

cs-suite

Cloud Security Suite - One stop tool for auditing the security posture of AWS/GCP/Azure infrastructure.

can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Pin-ApiTracer

Updated version of ApiTracer Pin tool

Meerkat

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

igoat

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

SubOver

A Powerful Subdomain Takeover Tool

ExploitDev

go-deliver

Go-deliver is a payload delivery tool coded in Go.

Seth

Perform a MitM attack and extract clear text credentials from RDP connections

arangodb

🥑 ArangoDB is a native multi-model database with flexible data models for documents, graphs, and key-values. Build high performance applications using a convenient SQL-like query language or JavaScript extensions.

XStreamServer

RCE Exploit PoC for Spring based RESTFul APIs using XStream as Unmarshaler

Invoke-ATTACKAPI

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API

ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

HELK

The Hunting ELK

security-onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

barnyard2

Barnyard2 is a dedicated spooler for Snort's unified2 binary output format.