Repository Index

Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.

• cisa-kev
• cve
• cve-poc
• cvss

evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)

• redteam-tools
• evasion
• bypass-antivirus
• bypass-edr

Pop shells like a master.

• shell
• reverse
• pop-shells
• hacking

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

• redteaming
• cpp
• pentesting-windows
• api-hooking

REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications

• fuzzing
• normalization
• regex
• waf-bypass

Academic papers related to fuzzing, binary analysis, and exploit dev, which I want to read or have already read

• fuzzing
• paper
• exploitation
• linux

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

• csrf
• crawler
• csrf-attacks
• token-generation

Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)

• hashcat
• password
• hashes
• cracking

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin.

Galah: An LLM-powered web honeypot.

• golang
• honeypot
• llm
• openai

honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway

• honeytoken
• honeypot
• security
• deception

Modern honeypot supporting multiple services, realistic website cloning, and AI-powered features

• cybersecurity
• honeypot
• python
• ai

Sectiv is a skill-driven AI security review for Burp Suite. Pick captured traffic and a review goal (IDOR, XSS, SQLi, SSRF…), and get a severity dashboard with description, steps to reproduce, impact, PoC, CWE/CVE and HTML/MD/JSON export. Built with Kotlin + Swing on the Montoya API.

Python API Monitor for Android apps

• android
• frida
• api
• monitoring

Rule Processor Y is a next-gen Rule processor with complex multibyte character support built to support Hashcat

• cybersecurity
• hashcat
• hashcat-rules
• johntheripper

Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis

• hashcat
• jtr
• mdxfind
• ngram

A tool that converts Bitwarden's data into a hashcat-suitable hash

Simple ELF runtime packer for creating self-protecting binaries

A CTF platform for The Many Hats Club