Identity & Access Management (IAM)

manuelberrueta/flowanalyzer

FlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).

portswigger/oauth-scan

Burp Suite Extension useful to verify OAUTHv2 and OpenID security

praetorian-inc/oauthseeker

A malicious OAuth application that can be leveraged for both internal and external phishing attacks targeting Microsoft Azure and Office365 users.

cyberark/skywrapper

SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS

sfewer-r7/cve-2026-55040

Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…

mathaix/openclawmachines

Manage OpenClaw in your team (Enterprise) by providing it compute infrastructure, tool integration, Authentication and security primitives

rhinosecuritylabs/iamactionhunter

An AWS IAM policy statement parser and query tool.

aydinnyunus/cve-2025-29927

CVE-2025-29927 Proof of Concept

lightspin-tech/red-shadow

Scans AWS IAM configurations for shadow admins by detecting misconfigured deny policies that fail to restrict user actions on groups, enabling…

henkru/cs-token-vault

In-memory token vault BOF for Cobalt Strike

d0ge/sign-saboteur

SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens

hikari-systems/slater

Low-memory graphdb with Bolt+tls support, at-rest encryption & vectors designed for local replica graph use cases.

jweny/shiro-cve-2020-17523

shiro-cve-2020-17523 漏洞的两种绕过姿势分析 以及配套的漏洞环境

zephrfish/ludus-defender-lab

MDE/MDI Defender setup for Ludus

sinsinology/cve-2024-29849

Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849)

wardgate/wardgate

Security gateway for AI agents - credential-isolated API proxying and policy-gated remote execution (conclaves). Reduce the blast radius!

blacksky-algorithms/atproto

Fork of the AT Protocol reference implementation with performance-optimized AppView, Rust-based firehose indexer, Redis caching, and community…