Fuzzing

danmcinerney/xsscrapy

XSS spider - 66/66 wavsep XSS detected

meliht/mr.sip

SIP Security Assessment Framework for VoIP Pentesters. Presented at DEFCON, BlackHat & Offzone.

mxmssh/drafl

AFL + DynamoRIO = fuzzing binaries with no source code on Linux

trailofbits/polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

tegal1337/pocketpentester

Offline-first Android offensive security toolkit with 21 modules for recon, port scanning, subdomain enumeration, SQLi/XSS/JWT exploitation, payload…

googleprojectzero/jackalope

Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android

vighnesh91/omnisec-hex

Browser-local security monorepo with six modules for mobile APK/IPA triage, client-side DAST fuzzing, OSINT directories, offline AI threat scoring,…

swisskyrepo/ssrfmap

Automatic SSRF fuzzer and exploitation tool

veridiff/veridiff

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

omar2535/graphqler

☸The first ever dependency-aware GraphQL API testing tool!

portswigger/splitting-the-email-atom

Research materials and tooling for exploiting email address parser discrepancies to bypass access controls, including fuzzers, Hackvertor tags, CSS…

karankantaria/binviz

Binary visualiser and triage tool — entropy, byte-class and Hilbert surfaces, dot plots and control-flow graphs over one shared address-space model.

vmoranv/jshookmcp

A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.

xairy/linux-kernel-exploitation

A collection of links related to Linux kernel security and exploitation

r0075h3ll/oralyzer

Python-based open redirect vulnerability scanner that fuzzes URLs to detect header, JavaScript, and meta tag-based redirects, with integrated…

panda-re/lava

LAVA: Large-scale Automated Vulnerability Addition