DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Repository Index
58,136 visible repositories in the index
1–11 of 11 · Most stars
Community curated list of templates for the nuclei engine to find security vulnerabilities.
- nuclei-templates
- nuclei
- bugbounty
- security
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
A professional, high-fidelity de-anonymization and vulnerability diagnostic framework. Features a zero-coupling modular architecture for browser-based intelligence gathering, hardware fingerprinting, and security research.
- browser-security
- cybersecurity
- de-anonymization
- ethical-hacking
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
- vulnerabilities
- scanner
- firefox-extension
- grunt-plugins
finds publicly known security vulnerabilities in a website's frontend JavaScript libraries
- security-vulnerabilities
- security
- vulnerabilities
- lighthouse
A DNS rebinding attack framework.
- dns-rebinding
- dns
- vulnerability
- attack
YakTrace reveals when multiple Yik Yak posts were made by the same anonymous account and organizes them into a local PDF dossier. Built on the sidechat.js API project.
- 0-day
- 0-day-exploit
- proof-of-concept
- vulnerability
The JavaScript Crypto Library provides web developers with an extensive and efficient set of cryptographic functions. The library aims to obtain maximum execution speed while preserving modularity and reusability. The library is released as open source under a BDS license.
A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.
Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.