Security

Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.

ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers (aka The Norton for OpenClaw)

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

JSON.parse with hard limits on nesting depth, key count, string length and input size. Refuses parser bombs before they are allocated.

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

A curated list of awesome OSCP resources

Chrome/Edge 浏览器扩展，5 规则实时检测银狐木马钓鱼仿冒网站。域名仿冒 · ICP备案核查 · 下载拦截 · 链接分析 · 代码工程化 — 零依赖 Manifest V3。

Low bandwidth DoS tool. Slowloris rewrite in Python.

💬 🚀 告别繁琐命令行，用自然语言驱动专业级渗透测试。 ⚡ 让安全测试从未如此简单、高效。Forget complex command lines. 🛡️ Professional penetration testing, powered by natural language.

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

A carefully organized, large-scale collection of cybersecurity and computer security books, research material, and technical references curated for students, researchers, and professionals. This repository serves as a central knowledge vault containing high-quality PDFs across core and advanced security domains — designed for structured learning,

List of Github repositories and articles with list of dorks for different search engines

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

Store, share, and resume AI coding sessions.

一款安全又便捷的网页加密工具。采用 AES-256 + PBKDF2 百万次迭代 + HMAC 验签，密码与解密全程留在浏览器本地；一条命令或图形界面即可把 HTML（乃至整站 css/js/图片）加密成自解密页面，部署到任意静态托管。Secure, effortless HTML encryption: AES-256, PBKDF2 (1M iterations), HMAC, with fully client-side decryption. Encrypt an entire site (CSS/JS/images) into a self-decrypting file via one command or GUI—deploy anywhere static.

Unlock an Android phone (or device) by bruteforcing the lockscreen PIN. Turn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! (no root, no adb)

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

How to improve NGINX performance, security, and other important things.

World's most accurate password guessing AI tool. A PyTorch implementation of PassLLM (USENIX 2025) that leverages PII and LoRA fine-tuning to outperform existing tools by over 45% on consumer hardware.

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

Get Keyboard,Mouse,ScreenShot,Microphone Inputs from Target Computer and Send to your Mail.

GitHub-native command-and-control framework for authorized security research, with encrypted multi-channel transport and resilient failover.

Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.

Zygisk module that intercepts Flutter app traffic — redirects to a proxy and bypasses BoringSSL TLS pinning. Persistent, no Frida session. Installable via MMRL.

Map your path from a low-priv user to roo, like BloodHound, for local Linux privesc.

DianXing - AI-Driven End-to-End Code Security Auditing

Git All the Payloads! A collection of web attack payloads.

A curated list of GPT agents for cybersecurity

⚙️ NGINX config generator on steroids 💉

Wiki to collect Red Team infrastructure hardening resources

A modern HTTP and HTTPS interception proxy with custom-made extensions support.

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, explainable findings, source exploration, AI-assisted investigation and professional reporting.

Fast Rust scanner to find leaked API keys on GitHub - OpenAI, Anthropic, Claude, GPT, AWS, Stripe, HuggingFace + 45 providers. Verify active secrets instantly.

Linux enumeration tool for pentesting and CTFs with verbosity levels

Security Guide for Developers

RedTiger-Tools is a multifunction automation tool dedicated to pentesting and OSINT. The project is open source and designed to be fully configurable according to user needs. It also includes a plugin system that allows users to extend or create new features, in order to centralize multiple tools into a single unified platform.

OSINT tool for finding profiles by username

面向开发人员梳理的代码安全指南

Automation for internal Windows Penetrationtest / AD-Security

ProfileHound - BloodHound OpenGraph collector for user profiles stored on domain machines. Make informed decisions about looting secrets by identifying active user profiles on domain machines.

DPI-SCANING-T2HASH: ابزار تخصصی آنالیز لایه-۰، تشخیص هوشمند DPI، کشف MTU و اسکنر فوق‌سریع کلودفلر. جراح دیجیتال شبکه ایران 🛡️🚀

You Know, For WEB Fuzzing !

File upload vulnerability scanner and exploitation tool.

Instantly disable Touch ID and lock your Mac with one click or keyboard shortcut.

Modular Go framework for attack surface management, reconnaissance, and vulnerability scanning.

The cheat sheet about Java Deserialization vulnerabilities

Security testing toolkit for AI Agent: curated SecLists wordlists, injection payloads, and expert agents for authorized pentesting, CTFs, and bug bounties

Collection of resources spanning key areas of Computer Science