Repository Index

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

• authentication
• automatic
• call
• coerce

Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab

• active-directory
• powershell
• redteaming
• penetration-testing

SSH-Snake is a self-propagating, self-replicating, file-less script that automates the post-exploitation task of SSH private key and host discovery.

• bash
• exploitation
• exploitation-tool
• hacking

Cryptographic filesystem for the cloud

• cryfs
• osxfuse
• filesystem
• crypto

PHP class to generate and verify Google Authenticator 2-factor authentication

Frida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic

• android
• frida
• certificate
• interception

Role and Attribute based Access Control for Node.js

• access-control
• abac
• rbac
• roles

A collection of JavaScript engine CVEs with PoCs

• javascript
• cve
• vulnerability

One Time Password (OTP) / 2FA for Node.js and Browser - Supports HOTP, TOTP and Google Authenticator

• hotp
• hmac
• otp
• authenticator

Collection of cryptographic hash functions written in pure Rust

• cryptographic-hash-functions
• blake2
• gost
• streebog

SpringBoot single sign-on authentication and authorization, implemented with OAuth 2.0, supporting cross-domain and distributed deployment.

• sso
• authentication
• authorization
• java

Magical authentication for Rails 3 & 4

• ruby
• rails
• authentication

Encrypt and Decrypt files securely in your browser.

• encryption
• file-encryption
• javascript
• client-side

Open-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.

• bypass-cloudflare
• bypass-hostname
• bypass-waf
• dnssec

A Vault swiss-army knife: A CLI tool to init, unseal and configure Vault (auth methods, secret engines).

• vault
• kubernetes
• kubernetes-secrets
• golang

FruityWiFi is a wireless network auditing tool. The application can be installed in any Debian based system (Jessie) adding the extra packages. Tested in Debian, Kali Linux, Kali Linux ARM (Raspberry Pi), Raspbian (Raspberry Pi), Pwnpi (Raspberry Pi), Bugtraq, NetHunter.

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐

• caddy-plugin
• caddy2
• security
• jwt

A collection of PHP backdoors. For educational or testing purposes only.

• php
• php-backdoor
• webshell

基础反检测 frida-server / Basic anti-detection frida-server

Handle roles and permissions in your Laravel application

• laratrust
• laravel
• roles
• authorization

🐳 The CUTEST visualnovel / galgame forum! Built with Nuxt4, GO Fiber and PostgreSQL. Kun Visual Novel forum 6th generation! 开源, 免费, 零门槛, 最先进的 Galgame 论坛社区!

• forum
• galgame
• jwt
• pinia

A JavaScript/TypeScript implementation of the complete Secure Hash Standard (SHA) family (SHA-1, SHA-224/256/384/512, SHA3-224/256/384/512, SHAKE128/256, cSHAKE128/256, and KMAC128/256) with HMAC.

• sha
• sha-1
• sha-2
• sha-3

Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On, it also supports Directory Sync via the SCIM 2.0 protocol for automatic user and group provisioning/de-provisioning.

• enterprise-software
• saml
• saml2
• saml-service-provider

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

• bugbounty
• subdomain
• dns
• dns-resolver