Tools

osirium/suds

Clone of suds 0.4 + suds-0.4-CVE-2013-2217.patch

leebaird/discover

Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload…

ethicalhackingplayground/tproxer

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

imperva/automatic-api-attack-tool

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.

boreas37/cve-2026-44848-poc

PoC for CVE-2026-44848: Portainer missing authorization on Docker plugin endpoints -> host RCE (GHSA-rrmm-9v76-h3p4). Stdlib-only Python.

quitten/autorize

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application…

payatu/tiredful-api

An intentionally designed broken web application based on REST API.

hahwul/authz0

Automated authorization testing tool that detects unauthorized access by scanning URLs with role-based credentials using YAML templates.

sh1yo/request_smuggler

Http request smuggling vulnerability scanner

shoucheng3/apache__dubbo_cve-2021-30180_2-7-9

Exploit for CVE-2021-30180 targeting Apache Dubbo RPC framework, enabling remote code execution via crafted RPC requests in vulnerable versions.

d0n601/cve-2025-12720

g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion

projectdiscovery/chaos-client

Go client to communicate with Chaos DB API.

tno-s3/wuppiefuzz

A coverage-guided REST API fuzzer developed on top of LibAFL

george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypass

Proof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…

mxm0z/r2s

A web-based vulnerability scanner for CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React Server Components.

amnnrth/cve-2025-34291_cors_security_scanner

A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing (CORS) misconfigurations - CVE-2025-34291.

hackinglz/maps_scanner

MAPS cloud scanner and response parser for Microsoft Defender research.

go-appsec/toolbox

Collaborative application security testing between humans and agents via CLI and MCP