Repository Index

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking

Translated404StarLink - Recommending high-quality, meaningful, interesting, and actively maintained open-source security projects

• opensource
• tools
• security

The recursive internet scanner for hackers. 🧡

• hacking
• neo4j
• osint
• osint-framework

TranslatedOneForAll is a powerful subdomain collection tool

• subdomain
• subdomain-scanner
• subdomain-enumeration
• subdomain-bruteforcing

WebGoat is a deliberately insecure application

Translated非线智能 NoneLinear (Non-linear Intelligence) - ReLE evaluation: capability evaluation of Chinese AI large models (continuously updated): it currently covers 374 large models, including commercial models such as chatgpt, gpt-5.4, Google gemini-3.1-pro, Claude-4.6, 文心 ERNIE-X1.1, ERNIE-5.0, qwen3.6-max, qwen3.6-plus, Baichuan, iFlytek Spark, and SenseTime senseChat, as well as open-source large models such as step3.5-flash, kimi-k2.6, ernie4.5, MiniMax-M2.7, deepseek-v4, Qwen3.6, llama4, Zhipu GLM-5.1, MiMo-V2, LongCat, gemma4, and mistral. It provides not only leaderboards but also a large model defect library with more than 2,000,000 entries! This makes it convenient for the broad community to research, analyze, and improve large models.

• agentic-ai
• artificial-intelligence
• llm-agent
• llm-evaluation

Sysmon configuration file template with default high-quality event tracing

• sysmon
• threatintel
• threat-hunting
• sysinternals

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

• vulnerabilities
• scanner
• firefox-extension
• grunt-plugins

Speed up a Laravel app by caching the entire response

• laravel
• php
• cache
• varnish

Create randomly insecure VMs

• security
• security-vulnerability
• virtualization
• randomization

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

• threat-modeling
• practical-devsecops
• security-review
• devsecops-university

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

• graphql
• security-scanner
• graphql-security
• api-documentation-tool

A big list of Android Hackerone disclosed reports and other resources.

• android
• hackerone
• android-repo
• android-security

Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities

DIVA Android - Damn Insecure and vulnerable App for Android

Memoize functions - an optimization technique used to speed up consecutive function calls by caching the result of calls with identical input

Interactive viewer for graphs written in Graphviz's dot language.

• python
• graphviz
• gtk
• xdot

In-App MongoDB Editor for Meteor (Meteor DevTools)

• meteor
• meteor-toys
• meteor-package
• insecure

⚡ Pi, the coding agent, compiled ahead of time to one native executable. 10× faster to start, 7× less CPU and 4.5× less memory than Pi on Node. Linux, macOS, Windows, ARM64 and Android (Termux).

• ahead-of-time
• bun
• coding-agent
• linux

A curated list of awesome resources about Electron.js (in)security

Content released at NorthSec 2018 for my talk on prototype pollution

dll injection tool that implements various methods

OWASP Honeypot, Automated Deception Framework.

• owasp
• honeypot
• honeynet
• deception

A modern and easy-to-use cryptographic library for .NET based on libsodium

• aead
• aes-gcm
• blake2b
• chacha20-poly1305