splitting-the-email-atom
portswigger/splitting-the-email-atomResearch materials and tooling for exploiting email address parser discrepancies to bypass access controls, including fuzzers, Hackvertor tags, CSS…
ctfeducationemail-security+7
99
portswigger/splitting-the-email-atomResearch materials and tooling for exploiting email address parser discrepancies to bypass access controls, including fuzzers, Hackvertor tags, CSS…
nxenon/h2spacexHTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy + Exploit Timing Attacks
albinowax/activescanplusplusBurp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, expression language injection, shellshock and…
hoodoer/colonelclusteredA Java Burp Plugin that performs text clustering on responses to identify outliers/groups based on the actual content of the server responses, say…
d0ge/websocketturbointruderBurp Suite extension for fuzzing WebSocket messages with custom Python code, supporting multiple engines, HTTP middleware routing, and response…
hackvertor/shadow-repeaterBurp Suite Repeater extension that automatically mutates payloads and analyzes responses to uncover path traversal, SQL injection, XSS, and other web…
piratesshield/apiharvesterThe one shot API attacker tool - finds the API url from the given root simulate the automated attacks
portswigger/http-terminatorAI-assisted research pipeline that extracts HTTP desync techniques, generates malformed request test-cases, validates them via Burp, and confirms…
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
rix4uni/wordlistCurated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…
forefy/reburpA Burp Suite extension that exposes the full Montoya API as a local REST API, with Swagger UI
se1ims/pixelsmashProof-of-concept and lab harness for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder, with payload generator and Qt demo player.
kabiri-labs/rcekitRCE detection and confirmation toolkit that tests URLs or captured HTTP requests for command injection, SSTI, blind and OOB paths, returning tiered…
mohammadalimehri/cve-2021-44790-labDockerized Apache mod_lua lab with a Python PoC reproducing the CVE-2021-44790 multipart boundary buffer overflow for local defensive testing and…
veridiff/veridiffDynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
vighnesh91/omnisec-hexBrowser-local security monorepo with six modules for mobile APK/IPA triage, client-side DAST fuzzing, OSINT directories, offline AI threat scoring,…
0xmarik/aresiusNative HTTP/HTTPS interception proxy for penetration testers and bug bounty hunters with live request tampering, request replay, high-speed fuzzing,…
anonmoty/xxstrikeXSStrike based XSS scanner with custom features. Detects XSS vulnerabilities in web applications.