#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
ritwick7/sudostampApprove sudo on a Linux workstation with a fingerprint on your Android phone. LAN only; the ECDSA key never leaves the phone's TEE and speaks the…
0xby7eme/windows-lpe-auditorA small Windows local-privilege-escalation (LPE) misconfiguration auditor with a terminal UI, built with C++20 and FTXUI
xhyumiracle/sudpSecret-Use Delegation Protocol — protocol-level secret use for agentic systems
kavryxdev-group/enterprise-abac-gatewayZero-trust reverse proxy and ABAC authorization gateway in Go with embedded OPA policy evaluation and distributed token revocation.
peach-research-lab/authorizationbenchThe first benchmark to evaluate how well do LLM agents act in alignment with their assigned authorization scope.
abraxas/superset-g3-v0-import-sql-plantProof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…
edtrackai/nextjs-supabase-stripe-security-checkerLocal static security scanner for Next.js, Supabase and Stripe apps: 24 AST-based checks for leaked keys, missing RLS and grants, unsafe webhooks.…
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
abraxas/openmeetings-soap-user-rightsApache OpenMeetings 9.1.0 - High - Remote - Privilege leftover - SOAP POST /user copies UserDTO.rights including ADMIN
abraxas/openmeetings-stale-install-adminApache OpenMeetings 9.1.0 - High - Remote - Privilege leftover - stale /install wizard inserts second ADMIN
abraxas/pfsense-ldap-name-collisionpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - LDAP admin name
abraxas/pfsense-api-export-key-getpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET export-key private keys
abraxas/pfsense-api-fleet-jwtpfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - one controller JWT is a fleet token
abraxas/opnsense-captive-lastseen-roamOPNsense 26.7.6 - High - Remote - Network-access bypass - captive lastseen roam
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
abraxas/bitwarden-cipher-create-aclBitwarden Server v2026.9.2 - High - IDOR - plant decryptable vault items into collections the caller cannot write
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
