#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
openziti/zitiZero-trust networking platform that makes services invisible with cryptographic identity, policy-based access, and end-to-end encryption. Replaces…
authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
keycloak/keycloakOpen Source Identity and Access Management For Modern Applications and Services
dbeaver/dbeaverFree universal database tool and SQL client
horizon3ai/vcenter_saml_loginA tool to extract the IdP cert from vCenter backups and log in as Administrator
nihal799/zttpZero-trust SSH bastion proxy with Vault-backed key management, RBAC policy enforcement, full session recording, and admin TUI for auditable access to…
ory/oathkeeperA cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s)…
freerdp/freerdpFreeRDP is a free remote desktop protocol library and clients
themehackers/cve-2025-29972CVE-2025-29927 is a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw…
xthalach/cve-2024-11318This repository details an IDOR vulnerability in AbsysNet 2.3.1, which allows a remote attacker to brute-force session IDs via the /cgi-bin/ocap/…
bp2008/dahualoginbypassChrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.
ovh/the-bastionAuthentication, authorization, traceability and auditability for SSH accesses.
goauthentik/authentikProvides open-source SSO and identity provider functionality with SAML, OAuth2/OIDC, LDAP, and RADIUS support for centralized authentication,…
cosignet/sdkThin TypeScript + zero-dep Python client and recipes to gate high-risk actions behind a payload-bound passkey approval.
opennhp/opennhpA lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the…
0dayninja/cve-2021-3560Polkit D-Bus Authentication Bypass Exploit
quarkslab/android-hardware-attestation-demoAn Android HW Attestation demo
aj2108/cve-2026-8239Security write-up for an IDOR in Concrete CMS exposing conversation ratings through missing authorization on the get_rating endpoint, with root…
