jacklosingheart/cve-2024-51132-pocProof-of-concept exploit for CVE-2024-51132, an XML External Entity (XXE) injection vulnerability in HAPI FHIR core libraries, enabling SSRF and…
ambitsecurity/jshoundFind every API request a web app makes, from the JavaScript it ships: method, URL, body, headers and GraphQL operations. One command.
blst-security/cherrybombCLI tool that audits OpenAPI specifications, validates them against best practices, and runs automated security tests to detect vulnerabilities and…
yalcinyolalan/wssatWEB SERVICE SECURITY ASSESSMENT TOOL
shinthink/blitzstrikeMCP server packaging a three-tier penetration-testing methodology: attack-surface reconnaissance, source-to-sink static analysis, and live finding…
momenbasel/vulnhawkAI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.
affolter-engineering/xssearchRust-based XSS scanner with context-aware payload selection, WAF detection and bypass, crawling, blind XSS callbacks, and static DOM sink analysis.
vighnesh91/securiscanStandard-library Python security triage engine that scans web apps, APIs, LLMs, and mobile packages via passive header inspection, active canary…
vighnesh91/-logicsentry-aiOffline SAST/DAST triage engine that parses source code and replays HAR traffic to detect business-logic flaws, BOLA, race conditions, and privilege…
gmh5225/enigma-C++ reimplementation of Ghidra's analytical core without JVM dependencies, providing embeddable binary analysis, Pcode/Sleigh foundations, and…
trailofbits/testing-handbookTrail of Bits Testing Handbook - appsec.guide
phanhoangkhang/react2shellIsolated Docker lab and static scanner for CVE-2025-55182, with vulnerable/patched Next.js builds and PoC validation of RSC Flight deserialization.
gaasedelen/patchingAn Interactive Binary Patching Plugin for IDA Pro
ikkisoft/parrotngJava-based tool to detect Adobe Flex SWF files vulnerable to CVE-2011-2461, usable as a command-line utility or Burp Suite passive scanner plugin.
aquasecurity/trivy-module-wordpressTrivy example module for WordPress
lifting-bits/sleighCMake build of Ghidra's SLEIGH processor specification library, providing standalone disassembly and p-code lifting engines for reverse engineering…
mynameismeerkat/pyreticpyREtic is an extensible framework for in-memory Python 2.x bytecode reverse engineering
lolcaken/javascript-deobfuscatorDeobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)
