#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
jweny/shiro-cve-2020-17523Analysis of two authentication bypass techniques for Apache Shiro (CVE-2020-17523) with a reproducible exploit environment and detailed root cause…
7hepr0fess0r/adcsdevilcomA C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using…
sinsinology/cve-2024-29849Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849)
saadahla/blockopenhandleBlock any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote memory…
wardgate/wardgateSecurity gateway for AI agents - credential-isolated API proxying and policy-gated remote execution (conclaves). Reduce the blast radius!
tuskira/ai-agent-gatewayOpen-source gateway that secures, governs, and observes AI agents' MCP tool calls and LLM traffic, with API-key authentication and an admin console…
w01fh4cker/screenconnect-authbypass-rceExploit script for CVE-2024-1708 and CVE-2024-1709 in ConnectWise ScreenConnect, enabling authentication bypass and remote code execution with user…
manuelberrueta/flowanalyzerFlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).
secureworks/whiskeysamlandfriendsPython-based framework for generating Golden SAML tokens, Kerberos tickets, and Azure Access Tokens to exploit federated identity systems and…
mx-moth/flask-saml2Flask library for building SAML Service Providers and Identity Providers
portswigger/oauth-scanBurp Suite Extension useful to verify OAUTHv2 and OpenID security
aydinnyunus/cve-2025-29927CVE-2025-29927 Proof of Concept
henkru/cs-token-vaultIn-memory token vault BOF for Cobalt Strike
lore-hex/quill-routerTrustedRouter.com repo for secure LLM proxying
d0ge/sign-saboteurSignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens
ymsniper/noeyesSecure terminal chat. E2E encrypted, zero-metadata blind-forwarder server. PyNaCl XSalsa20-Poly1305 + Ed25519 + forward secrecy. Cross-platform…
sfewer-r7/cve-2026-55040Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…
haidang-infosec/phantom-gridAn eBPF-powered Active Defense system that turns your Linux server into a deceptive honeypot. Features transparent traffic redirection, OS…
