Open-source alternatives to Padding Oracle Attacker

Ciphey is an automated decryption tool and cryptographic analysis framework designed to identify and reverse encryptions, encodings, and hashes without requiring a known key or cipher. It functions as a hash cracking engine and a heuristic cipher identifier to recover original plaintext from unknown data patterns. The project features a nested encoding resolver that iteratively unwraps multiple layers of encryption and encoding until readable text is reached. It employs a heuristic cryptanalysis workflow to analyze data characteristics and guess the likely encoding scheme or encryption method

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

An MCP (Model Context Protocol) server that brings the capabilities of the enigmapython library to LLMs, allowing them to encrypt and decrypt messages using historically accurate Enigma machine emulators

This tool is a command-line utility designed for automated web resource discovery, fuzzing, and application structure mapping. It functions as a security-focused scanner that identifies hidden files, directories, parameters, and virtual hosts by injecting payloads into HTTP requests. By systematically testing how servers handle various inputs, it assists in mapping the architecture of web applications and uncovering potential security vulnerabilities. The tool distinguishes itself through a highly concurrent engine that manages asynchronous request execution and recursive job orchestration. I

RsaCtfTool is a specialized cryptography suite designed for solving capture-the-flag challenges. It serves as a cryptanalysis and key recovery tool used to derive private keys and decrypt data from weak RSA public key implementations. The tool functions as an integer factorization toolkit, employing a variety of mathematical attacks and algorithms to decompose large composite numbers into their prime factors. It integrates with external prime number databases to accelerate the factorization process and identifies specific mathematical vulnerabilities in key generation. Its capabilities cover

Monkey is an adversary emulation platform and breach and attack simulation tool designed to test network defenses through automated lateral movement and exploit delivery. It functions as a network security testing system that evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials. The platform distinguishes itself by simulating specific real-world attacker behaviors, such as ransomware encryption, cryptojacking, and the theft of browser-stored credentials and secure shell keys. It utilizes binary hash randomization to evade antiv

A tool to analyze multi-byte xor cipher

A tool for bug hunting or pentesting for targeting websites that have open .git repositories available in public

rsatool can be used to calculate RSA and RSA-CRT parameters

Aplicación de protección contra filtraciones de documentos desarrollada en Python. Utiliza watermarks cifrados con AES-256 y seguimiento en base de datos para detectar posibles filtraciones. ¡Protege tu propiedad intelectual con tecnología avanzada! 🛡️

recon-ng is an open source intelligence reconnaissance framework designed to automate the collection and aggregation of public information. It is a modular intelligence tool that utilizes a system of pluggable modules to harvest target data, resolve DNS queries, and parse web content. The framework is built as an API-driven tool with a programmatic interface to integrate with other security workflows. It is provided as a containerized application, using Docker to ensure a consistent environment for running reconnaissance tasks and managing a persistent data store. Its capabilities cover exte

Pure-Python MCP server for encoding, hashing, and crypto-primitives — computed for real, locally.

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor