Repository Index

TranslatedWeChat 4.x database decryption and analysis, supporting real-time updates, export of chat records and Moments, and annual summaries.

Java bytecode engineering toolkit

• java-bytecode
• java

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

• malware
• deobfuscation
• strings
• flare

:orange_book: Markdown Templates for Offensive Security OSCP, OSWE, OSCE, OSEE, OSWP exam report

• oscp
• offensive-security
• report
• oscp-prep

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

• vulnerabilities
• scanner
• firefox-extension
• grunt-plugins

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

• bro
• scans
• nmap
• network

State-of-the-art native debugging tools

• hypervisor
• hyperdbg
• debugger
• ept

UNIX-like reverse engineering framework and command-line toolset.

• reverse-engineering
• program-analysis
• security
• exploitation

A repository with 3 tools for pwn'ing websites with .git repositories available

OAuth Proxy

• nodejs
• javascript
• oauth
• oauth2

🛠 Secure, stateless, and cookie-based session library for Next.js or any JavaScript framework

• nextjs
• authentication
• session
• stateless

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

• malware
• virustotal
• malpedia
• urlhaus

Advanced vm/sandbox for Node.js

• javascript
• sandbox
• vm
• security

A high performance offensive security tool for reconnaissance and vulnerability scanning

• reconnaissance
• scanner
• vulnerability-assessment
• vulnerability-scanner

Android Reverse-Engineering Workbench for VS Code

• apktool
• apk-decompiler
• apk-editor
• smali

Snoop — инструмент разведки на основе открытых данных (OSINT world)

• osint
• termux
• username-search
• username-checker

:busts_in_silhouette: A bash-tool to store your private data inside a git repository.

• git-secret
• git
• git-addons
• gpg

Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.

Linux enumeration tool for pentesting and CTFs with verbosity levels

• hacking
• pentesting
• privilege-escalation
• linux-enumeration

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

• burpsuite
• intruder
• payloads
• fuzz-lists

Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.

• github
• github-api
• security
• osint

A highly specialized reverse-engineering pipeline designed to structurally transplant original Vanilla character models into the EverQuest Online Adventures: Frontiers (PS2) game engine, resolving complex Vector Unit 1 (VU1) shader bugs, Emotion Engine (EE) memory overflows, and PS2 CDVDman hardware faults.

• assets
• eqoa
• eqoa-frontiers
• game

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.