Repository Index

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

• pentesting
• security
• chrome-extension
• api-keys

Elixir encryption library designed for Ecto

• elixir
• encryption
• ecto
• hex

A collection of programs that access and manipulate ELF files.

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

• xss
• bxss
• security
• bugbounty

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

Compilation of autoexec scripts and mods for Xiaomi Yi camera after reverse engineering of firmware.

• reverse-engineering
• xiaomi
• xiaomi-firmware
• xiaomi-camera

A collection of useful utility functions

• utility
• utilities
• string
• strings

This is quick session for net/http in golang. This package is perhaps the best implementation of the session mechanism, at least it tries to become one.

• go
• golang
• session

Chiron - An IPv6 Security Assessment framework with advanced IPv6 Extension Headers manipulation capabilities.

• ipv6
• security-assessments

Zero-code K8s sidecar for log sanitization. Detects secrets via Entropy Analysis, preserves JSON integrity, and redacts PII deterministically. 🛡️

• devsecops
• entropy
• gdpr
• golang

The Redexer binary instrumentation framework for Dalvik bytecode

• dex
• dynamic-analysis
• bytecode-manipulation
• dalvik

php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.

• cve
• hestiacp
• opencart
• php

Extract the information needed from the Manifest.plist files to convert it to hashes compatible with hashcat

Middleware based authorization for Absinthe GraphQL powered by Bodyguard

Upload files securely

• rack
• rails
• security
• upload

Simple tool to extract the most common substrings from an input text. Built for password cracking.

• passwords
• cracking
• string-manipulation
• wordlist-generator

Defensomania is a security monitoring and incident response card game.

• incident-response
• self-assessment
• incident-response-readiness
• educational-game

Google Summer of Code 2012 project, supported by The Honeynet Project organization.

Better JSON::Any for Crystal

• crystal
• hash
• json
• yaml

Website to Scrapping all writeup from http://ctftime.org/ and you can organize which to read first!

Prevent your secrets from leaking into logs, std* etc.

• go
• secrets

Collection of danish base wordlists for cracking danish passwords (Hashcat, John the Ripper etc.)

• password-cracking
• wordlists
• hashcat-lists
• hashcat

Mochi is a authentication shard inspired by devise. Mochi is designed for the Amber framework with support for both Granite & Jennifer ORM's.

An easy to use licensing system, using asymmetric cryptography to generate and validate licenses.

• jwt
• paseto
• nacl
• authentication