#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended
certbot/certbotCertbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any…
firezone/firezoneWireGuard-based zero-trust access platform providing secure, peer-to-peer remote access with granular policy controls, SSO authentication, and audit…
crowdstrike/crtAudits Azure AD and Exchange Online configurations for hard-to-find permissions, federation trusts, mail forwarding rules, and delegated access to…
exfil0/cve-2024-55591-pocA comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability…
xthalach/cve-2024-11318This repository details an IDOR vulnerability in AbsysNet 2.3.1, which allows a remote attacker to brute-force session IDs via the /cgi-bin/ocap/…
cosignet/sdkThin TypeScript + zero-dep Python client and recipes to gate high-risk actions behind a payload-bound passkey approval.
bishopfox/iam-vulnerableUse Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.
f-bader/tokentacticsv2A fork of the great TokenTactics with support for CAE and token endpoint v2
wattocyber/agentic-dm-gatewaySecurity control plane for LLM agents: allowlists, owner kill switch, PIN sessions, rate limits, prompt-injection detection, and output scrubbing to…
pushsecurity/browser-identity-attacks-matrixOffensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they…
aydinnyunus/cve-2025-29927CVE-2025-29927 Proof of Concept
themehackers/cve-2025-29972CVE-2025-29927 is a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw…
jakehildreth/locksmith2An AD CS toolkit for AD Admins, Defensive Security Professionals, and Filthy Red Teamers
g4bri-3l3/idwolfRead-only Active Directory & Microsoft Entra ID hygiene auditor in pure PowerShell. Collect once, analyze offline: deterministic findings, attack…
fabacab/awesome-cybersecurity-blueteam:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
sinsinology/cve-2024-29849Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849)
chelof100/acp-framework-enAgent Control Protocol (ACP) — Official English specification. Cryptographically verifiable authorization architecture for autonomous AI agents.
squ1dw3rm/cve-2023-52268Authentication Bypass for FreeScout End-User Portal
