security

Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

Awesome Vulnerable Applications

One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Infra provides authentication and access management to servers and Kubernetes clusters.

SSH-MITM - ssh audits made simple

Firmware Analysis and Comparison Tool

Username tools for penetration testing

Vulnerable app with examples showing how to not use secrets

Community-driven baseline to accelerate Intune adoption and learning.

Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

Perform a MitM attack and extract clear text credentials from RDP connections

🔐 Run frida-server on boot with Magisk, always up-to-date

Privacy-first PDF utility (Zero-Server Architecture). Merge, split, compress, and edit PDFs 100% locally on your device. No uploads, no servers, no tracking.

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more.

LLM powered fuzzing via OSS-Fuzz.

🔐 Out of the box stateless openvpn-server docker image which starts in less than 2 seconds

保护你的浏览器指纹 | Protect Your Browser Fingerprints | Chrome, Edge, Firefox | 扩展 / Extension

📗 How to write cross-platform Node.js code

A free book about developing secure and robust systems software.

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.

Minimal TOTP generator in 20 lines of Python

Enhance the security and privacy of your Windows 10 and Windows 11 deployments with our fully optimized, hardened, and debloated script. Adhere to industry best practices and Department of Defense STIG/SRG requirements for optimal performance and security.

Home Assistant integration to manage Eufy Security devices as cameras, home base stations, doorbells, motion and contact sensors.

Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!