Open-source alternatives to Secure

Commix is an automated tool for detecting and exploiting OS command injection vulnerabilities in web applications. It probes user-supplied input vectors with heuristic test payloads, analyzes response differences to identify injection points, and then automates the execution of arbitrary operating system commands on the target server. The tool distinguishes itself through a multi-layer filter bypass engine that evaluates input constraints independently per filter type and composes tailored evasion strategies into a single payload. A modular payload tamper pipeline transforms raw injection str

Kali Linux Fixes for Newly Imported VM's

A high performance offensive security tool for reconnaissance and vulnerability scanning

CyberChef is a web-based application designed for performing complex data encoding, decoding, encryption, and analysis tasks. It provides a visual interface where users construct data transformation pipelines by chaining modular operations together, allowing raw input to be processed into a desired output format entirely within the local browser environment. The tool functions as a client-side cryptographic workbench, ensuring that all data processing logic remains local to the user's machine to maintain privacy and eliminate server-side overhead. By utilizing functional pipeline composition

Hashcat is a high-performance hash cracking software and OpenCL compute application used to recover plain-text passwords from hashed data. It functions as a GPU-accelerated recovery tool and distributed password cracker, leveraging CPUs and GPUs to perform intensive cryptographic computations. The system differentiates itself through a distributed cracking workflow that coordinates tasks across multiple machines via an overlay network to share computational load. It further optimizes recovery speed using Markov chain keyspace optimization to prioritize the most likely password candidates. Th

A tool for parsing breached passwords

theHarvester is a command-line utility designed for gathering open-source intelligence and mapping an organization's external attack surface. It functions as a security information gathering framework that automates the collection of publicly available data to assist in reconnaissance and threat analysis. The tool utilizes a plugin-based architecture to execute isolated queries against various search engines and public databases. It employs asynchronous task execution to run multiple discovery operations in parallel, while a centralized pipeline aggregates and deduplicates findings from these

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

UglifyJS is a tool for JavaScript code minification, AST manipulation, and source beautification. Its primary purpose is to reduce the file size of JavaScript source code by removing whitespace and shortening variable names to optimize frontend build assets. The project differentiates itself through its ability to programmatically analyze and transform code using abstract syntax trees. It performs constant folding analysis and conditional compilation to eliminate unreachable or redundant code, and it employs a multi-pass compression pipeline to maximize total file size reduction. The tool pr

Interactsh is an out-of-band security testing framework and interaction server designed to detect vulnerabilities such as server side request forgery and blind injections. It functions as a multi-protocol interaction collector that captures DNS, HTTP, and SMTP requests to verify outbound communication from remote applications. The project provides a self-hosted interaction gateway for managing unique payloads and gathering network interactions across multiple domains. It distinguishes itself through the ability to simulate various network protocols and response behaviors, including the routin

Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms.

The framework is a comprehensive penetration testing platform designed for the development, testing, and execution of security exploits. It serves as a research toolkit and automated assessment environment, enabling security professionals to identify and validate vulnerabilities within networked systems and infrastructure through repeatable, standardized procedures. The platform distinguishes itself through a modular architecture that supports reflective payload injection, allowing for the execution of code directly in memory without writing to disk. It utilizes an asynchronous event loop to

A Flask extension providing Argon2 hashing and comparison.

declutters url lists for crawling/pentesting

This project is an automated security testing suite designed to detect and exploit database vulnerabilities. It functions as a command-line utility that streamlines the identification, verification, and exploitation of web application flaws by automating the injection of malicious payloads into input parameters. The tool provides a comprehensive framework for database enumeration, allowing users to extract schema information, user data, and system configurations from identified injection points. What distinguishes this tool is its sophisticated engine for dynamic payload adaptation and heuris

A tool for adding new lines to files, skipping duplicates

A wrapper around grep, to help you grep for things

Accept URLs on stdin, replace all query string values with a user-supplied value

Pull out bits of URLs provided on stdin

Talisman: HTTP security headers for Flask