Repository Index

The ZAP by Checkmarx Core project

• zap
• zap-development
• dast
• appsec

The Browser Exploitation Framework Project

Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.

The Leading Security Assessment Framework for Android.

• drozer
• android
• security
• pentesting

A python script that finds endpoints in JavaScript files

• infosec
• endpoints

XSS'OR - Hack with JavaScript.

• probe
• pentest-tool
• xss
• csrf

The new bridge between Burp Suite and Frida!

A DNS rebinding attack framework.

• dns-rebinding
• dns
• vulnerability
• attack

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

• application-security
• appsec
• bug-bounty
• burp-alternative

A mostly-serverless distributed hash cracking platform

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

• dns
• dns-rebinding
• hacking
• malicious-domains

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

• xss
• bxss
• security
• bugbounty

JShell - Get a JavaScript shell with XSS.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

• dns-rebinding
• dns
• hacking
• red-team

DNS Rebinding Exploitation Framework

• dns-rebinding
• red-team
• hacking
• web-hacking

Code for cracking passwords with neural networks

PETEP (PEnetration TEsting Proxy) is an open-source Java application for traffic analysis & modification using TCP/UDP proxies. PETEP is a useful tool for performing penetration tests of applications with various application protocols. ⚡

• proxy
• tcp
• tcp-proxy
• penetration-testing

Nail in the JKS coffin - Cracking passwords of private key entries in a JKS file

TranslatedFush Vue MCP — Vue frontend reverse engineering + web security testing tool (Chrome extension + MCP server, 91 tools)

• ai-agents
• anti-debug
• chrome-extension
• mcp

BLE Edition of the original FistBump (portable WPA handshake grabber)

:ghost: :flashlight: Invisible JS code execution & social engineering.

Rule Processor Y is a next-gen Rule processor with complex multibyte character support built to support Hashcat

• cybersecurity
• hashcat
• hashcat-rules
• johntheripper

Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis

• hashcat
• jtr
• mdxfind
• ngram