Awesome GitHub RepositoriesSecurity Utilities

This project is a general-purpose command-line filter that provides an interactive interface for processing standard input streams. It enables real-time fuzzy searching, data selection, and transformation, allowing users to navigate complex information or file systems directly within their terminal. By utilizing a pipe-oriented architecture, it integrates into existing shell pipelines and workflows to facilitate efficient data exploration. What distinguishes this tool is its highly extensible, event-driven design that allows for deep integration with external processes. It supports asynchrono

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

CyberChef is a web-based application designed for performing complex data encoding, decoding, encryption, and analysis tasks. It provides a visual interface where users construct data transformation pipelines by chaining modular operations together, allowing raw input to be processed into a desired output format entirely within the local browser environment. The tool functions as a client-side cryptographic workbench, ensuring that all data processing logic remains local to the user's machine to maintain privacy and eliminate server-side overhead. By utilizing functional pipeline composition

Mobile Security Framework is an automated security testing platform designed for the analysis of Android, iOS, and Windows mobile application binaries. It functions as a comprehensive suite for identifying security vulnerabilities, privacy risks, and malicious code within mobile software packages. The framework distinguishes itself by combining static and dynamic analysis techniques to evaluate application behavior. It performs static inspection of source code and binaries to detect insecure patterns, while simultaneously utilizing dynamic instrumentation and containerized sandboxing to monit

Hurl is a command line HTTP testing tool and REST API test runner that uses a declarative, plain-text format to specify HTTP requests and responses. It functions as a client for continuous integration pipelines, allowing users to describe request sequences without a full programming language. The tool distinguishes itself by sequencing HTTP calls and verifying responses through matchers and variable capture. It maintains a stateful variable store, enabling data extracted from one response to influence subsequent requests within a workflow. The system covers API integration testing and REST w

Wuzz is an interactive command line HTTP client and request inspector designed for capturing, reviewing, and analyzing outgoing network calls and their payloads. It functions as a terminal-based tool for debugging API issues and testing web endpoints. The tool provides specialized filtering for response bodies, using regular expressions and format-specific query syntaxes tailored for JSON and HTML data. It allows for the persistence of captured requests and responses to disk to facilitate the reproduction of network issues and offline analysis. User settings and default request behaviors are

jsfuck is an esoteric programming language and JavaScript source obfuscator. It functions as a code encoder that transforms standard JavaScript source code into a functional equivalent composed of a minimal character set. The project restricts its source code to six specific characters to hide logic and bypass security filters that block standard alphanumeric characters. It achieves this by using type coercion to derive symbols and accessing internal language objects through prototype manipulation. The system enables arbitrary JavaScript execution by converting strings into executable functi

Grex is a regular expression generator and Rust pattern library that synthesizes a single regular expression from a set of provided text test cases. It functions as a command-line tool and a library, utilizing a Rust-based engine to analyze commonalities across input strings to create matching patterns. The project distinguishes itself through Unicode-aware grapheme processing, ensuring consistent matching across diverse character sets and non-ASCII text. It also provides Python bindings to make its core Rust logic available within Python environments. The system covers pattern generalizatio

ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl

A collection of custom security tools for quick needs.

Interactive CTF Exploration Tool

A tool for adding new lines to files, skipping duplicates

Some files for bruteforcing certain things.

Quick SQLMap Tamper Suggester

Utility program to perform multiple operations for a given subnet/CIDR ranges.

Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets

A tool to embed XXE and XSS payloads in docx, odt, pptx, xlsx files (oxml_xxe on steroids)

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.