Awesome GitHub RepositoriesSession Hijacking

Hermes-webui is a self-hosted AI orchestrator and web interface for managing autonomous agents. It serves as a multi-provider gateway that connects cloud and local large language models, providing a central hub to execute scheduled background jobs, run shell commands, and manage agent memory on private hardware. The system distinguishes itself through a persistent memory manager that utilizes knowledge graphs and markdown files for long-term context across sessions. It features a model context protocol host for extending agent capabilities with standardized tools and supports the orchestratio

Evilginx2 is a man-in-the-middle phishing framework designed to proxy authentication traffic between a user and a target web service. By acting as a reverse proxy, the tool intercepts and relays web requests to capture credentials and session tokens in real time, enabling the bypass of multi-factor authentication mechanisms through session cookie hijacking. The platform distinguishes itself by integrating infrastructure orchestration with modular template-driven content injection. It automates the deployment of proxy servers, manages the lifecycle of encryption certificates, and applies conte

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Undiscord is a browser-based tool that deletes all messages from a Discord channel or direct message conversation by running a self-contained JavaScript snippet in the developer console. The script leverages the user's existing browser session, including cookies and authentication tokens, to impersonate the user and execute Discord API calls without re-authentication. The tool deletes messages one by one via Discord's REST API endpoints, processing each response before sending the next request, and implements custom delay logic between API calls to avoid Discord's rate-limiting thresholds. It

bb-browser is an authenticated web scraper and browser automation CLI that also functions as an MCP server for AI coding tools. It treats the browser as a programmable runtime environment, enabling AI agents to control a live Chrome instance through a standard protocol while leveraging existing login sessions for authenticated actions. The project distinguishes itself through a dual CLI and MCP interface, allowing both direct command-line control and AI-driven browser manipulation. It includes a parallel multi-platform query engine that executes simultaneous searches across multiple websites,

BrowserMCP is a browser automation bridge that connects AI tools to a live browser session through a local proxy server. It implements a standardized protocol for sending commands like click, type, and navigate to a real browser instance running on the user's machine, while keeping all browsing data on the device. The project distinguishes itself by preserving user sessions and fingerprints across automation tasks. It attaches to the user's existing browser profile to maintain cookies, logins, and authentication state, and uses the real browser's user agent, viewport, and extension context to

Naabu is a port scanner library and tool that probes hosts for open ports using SYN, CONNECT, and UDP methods to identify active services. It functions as a Go library for embedding port scanning into programs, and as a standalone tool that accepts targets as hostnames, IP addresses, CIDR ranges, or ASN numbers. The tool discovers live hosts before scanning, filters ports by range or top lists, and can integrate with Nmap for service version detection. The project distinguishes itself through its SYN-based port probing approach that sends TCP SYN packets and analyzes responses without complet

यह प्रोजेक्ट एक LLM ब्राउज़र ऑटोमेशन फ्रेमवर्क और AI एजेंट ब्राउज़र इंटरफ़ेस है। यह एक नियंत्रण परत के रूप में कार्य करता है जो प्राकृतिक भाषा के निर्देशों को बड़े भाषा मॉडल का उपयोग करके ब्राउज़र इंटरैक्शन में अनुवादित करता है, जिससे AI एजेंटों को मानकीकृत ब्राउज़र-नियंत्रण फ़ंक्शंस के माध्यम से वेब पेजों को नेविगेट करने और उनके साथ इंटरैक्ट करने में सक्षम बनाता है। यह सिस्टम एक RPA वर्कफ़्लो ऑर्केस्ट्रेटर और हेडलेस ब्राउज़र प्रबंधन उपकरण के रूप में कार्य करता है, जो दोहराव वाले कार्यों को स्वचालित करने के लिए नियतात्मक ब्राउज़र अनुक्रमों को रिकॉर्ड और रीप्ले करने में सक्षम है। यह बॉट डिटेक्शन को बायपास करने और CAPTCHAs को हल करने के लिए रेजिडेंशियल प्रॉक्सी और संशोधित ब्राउज़र इंजन सहित स्टील्थ कॉन्फ़िगरेशन के माध्यम से खुद को अलग करता है। यह प्लेटफ़ॉर्म क्षमताओं की एक विस्तृत श्रृंखला को कवर करता है, जिसमें संरचित वेब डेटा निष्कर्षण, प्रमाणीकरण बनाए रखने के लिए पर्सिस्टेंट सेशन प्रबंधन, और मल्टी-फैक्टर ऑथेंटिकेशन जैसे जटिल चरणों के लिए ह्यूमन-इन-द-लूप हस्तक्षेप शामिल है। यह स्थानीय कनेक्टिविटी और प्रबंधित क्लाउड सैंडबॉक्स परिनियोजन दोनों का समर्थन करता है, जो इंटरैक्टिव ग्राफ़ के माध्यम से विज़ुअल वर्कफ़्लो प्रबंधन और रीयल-टाइम गतिविधि निगरानी प्रदान करता है। एकीकरण बाहरी LLM प्रदाताओं और तृतीय-पक्ष ऑर्केस्ट्रेशन प्लेटफ़ॉर्म के लिए कमांड-लाइन इंटरफ़ेस और API कनेक्टिविटी के माध्यम से प्रदान किया जाता है।

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij