Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

PostScript examples useful for attacking Ghostscript.

Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions

A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.

♥

convert case style of words

Deobfuscate obfuscator.io, unminify and unpack bundled javascript

MassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy input-output support.

HackerOne资产更新 | 每日更新HackerOne资产，对HackerOne的资产进行爬行和整理，SRC资产更新仅会增加，不会进行删除，每天更新的可以进行差异化对比来获取到新的项目资产范围

A tool to compare two APK files at the dex level. Useful for checking the impact of things like fullMode and dex optimisations.

Frida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic

NeXSS is a modern, self-hosted Blind XSS (Cross-Site Scripting) hunter and callback listener built with Next.js. It helps security researchers and penetration testers discover and validate blind XS…

Unified datasets for public cloud provider IP ranges. Providers include AWS, Azure, CloudFlare, DigitalOcean, Fastly, Google Cloud and Oracle Cloud.

An up-to-date export of cloud provider IP address ranges

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

Empty project to quick start Proof of Concept app development

🔓A Curated List Of Modern Android Exploitation Conference Talks.

Python-based static analyzer for Android APKs that extracts attack surface and flags high-risk vulnerability patterns with lightweight taint heuristics.

Repo containing reports and PoCs for a selection of vulnerabilities I have discovered and that have been assigned a CVE identifier.

A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.

ART环境下自动化脱壳方案

An MCP Server for Chrome DevTools, following the Chrome DevTools Protocol. Integrates with Claude Desktop and Claude Code.

DursVuln - Nmap Scripting Engine (NSE)

Plugin for JADX to integrate MCP server

A tool for reverse engineering Android apk files

Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store

Vulnerable environments paired with ready-to-use Nuclei templates for security testing and learning! 🚀