Tools

6mile/gimmepatz

Personal Access Token (PAT) recon tool for bug bounty hunters, pentesters & red teams

nolabs-ai/nono

secure multiplexed execution paths for agents - zero trust, zero setup, zero latency.

foxboron/ssh-tpm-agent

SSH agent that creates and manages TPM-sealed keys for hardware-bound authentication, supporting key generation, import, wrapping, PIN protection,…

cisagov/scubagear

Automation to assess the state of your M365 tenant against CISA's baselines

compasssecurity/entrafalcon

A lightweight PowerShell tool for assessing the security posture of Microsoft Entra ID environments. It helps identify privileged objects, risky…

gravitational/teleport

The easiest, and most secure way to access and protect all of your infrastructure.

tech4242/aquaman

🔱 The only independent credential proxy for AI agents: bring-your-own-vault isolation & least-privilege request policies. Your keys stay where you…

azuread/azureadassessment

Tooling for assessing an Azure AD tenant state and configuration

baram01/webui

WebUI for AAA

ory/oathkeeper

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s)…

open-policy-agent/opa

Declarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…

roxanne_ardary/securecivic

SecureCivic is a citizen-built, open source identity verification platform designed for SSA adoption. It replaces private data brokers with a secure,…

bastillion-io/bastillion

Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.

spiffe/spire

Workload identity platform that attests running services, issues SPIFFE IDs/SVIDs, and enables mTLS and JWT authentication for Kubernetes,…

knavesec/credmaster

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

praetorian-inc/oauthseeker

A malicious OAuth application that can be leveraged for both internal and external phishing attacks targeting Microsoft Azure and Office365 users.

stra-x/outoftune

Rogue device enrollment tool for Entra ID and Intune MDM. Automates device join, token acquisition, MDM enrollment, and OMA-DM checkin to extract…

shanika04/cloudfoundry_uaa

CVE-2016-4468