Amal Murali

antislop. By slop for slop, to remove slop in an AI slop world.

file-itr. Python

mantis. A modular, stack-agnostic toolkit of security review skills for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

TokenBurn. HTML

exploitbench. ExploitBench measures how far AI agents climb, from reaching vulnerable code, to triggering the bug, to building exploit primitives, to arbitrary code execution.

ironcurtain. A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

copy-fail-CVE-2026-31431. Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code

clearwing. Python

whoop-mcp-server. Python

distil-ai-slop-detector. Detect AI-generated text locally in your browser

claude-code-clone. A Claude Code orchestration layer that lets teammates reach your project context through Slack or Telegram while you're away, routing requests to the right workspaces on your own system.

claude-code-log. A Python CLI tool that converts Claude Code transcript JSONL files into readable HTML / Markdown format.

showboat. Create executable documents that demonstrate an agent's work

rodney. CLI tool for interacting with the web

ironclaw. IronClaw is an Agent OS focused on privacy, security and extensibility

vulnerability-spoiler-alert-action. GitHub Action to alert on security patches before the CVE drops.

claude-code-devcontainer. Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

nanoclaw. A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK

beautiful-mermaid. TypeScript

skills. Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

react2shell-scanner. High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)

CVE-2025-55182-research. CVE-2025-55182 POC

http-request-smuggler. Java

remote-mcp-scanner. Python

quickstart-resources. A repository of servers and clients from the Model Context Protocol tutorials

inspector. Visual testing tool for MCP servers

pqcscan. Post-Quantum Cryptography Scanner - Scan SSH/TLS servers for PQC support

newtowner. Abuse trust-boundaries to bypass firewalls and network controls

jxscout. jxscout superpowers JavaScript analysis for security researchers

FrogPost. FrogPost: postMessage Security Testing Tool

posthog. :hedgehog: PostHog is the leading platform for building self-driving products. Our developer tools – AI observability, analytics, session replay, flags, experiments, error tracking, logs, and more – capture all the context agents need to diagnose problems, uncover opportunities, and ship fixes. Steer it all from Slack, web, desktop, or the MCP.

awesome-cursorrules. 📄 Configuration files that enhance Cursor AI editor experience with custom rules and behaviors

baddns. Check subdomains for subdomain takeovers and other DNS tomfoolery

life-in-weeks. 📍 A map of my life, where each week I've been alive is a little box.

cognee. Cognee is the open-source AI memory platform for agents. Give your AI agents persistent long-term memory across sessions with a self-hosted knowledge graph engine.

httptap. View HTTP/HTTPS requests made by any Linux program

undetected-chromedriver. Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)

MisguidedAttention. A collection of prompts to challenge the reasoning abilities of large language models in presence of misguiding information

meta-ios-pinning. Updated version of https://codeshare.frida.re/@Numenorean/ios-instagram-facebook-ssl-pinning-bypass/

nowafpls. Burp Plugin to Bypass WAFs through the insertion of Junk Data

vm_challenge.

xzbot. notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

limiter. A small command-line utility to artificially limit the input rate to STDIN.

Fabric. Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.

burp-awesome-tls. Burp extension to evade TLS fingerprinting. Bypass WAF, spoof any browser.

bug-bounty-reference. Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

swagroutes. swagroutes is a command-line tool that extracts and lists API routes from Swagger files in YAML or JSON format.

cve. Gather and update all available and newest CVEs with their PoC.

E2B. Open-source, secure environment with real-world tools for enterprise-grade agents.

dtmf-decoder. Extract phone numbers from an audio recording of the dial tones.

socksprox. Shell

awesome-intelligence-writing. Collection of awesome resources on intelligence writing, including manuals/guides, standards, books, tranings, articles, videos, etc

awesome-security-newsletters. Periodic cyber security newsletters that capture the latest news, summaries of conference talks, research, best practices, tools, events, vulnerabilities, and analysis of trending threats and attacks

regulator. Automated learning of regexes for DNS discovery

oscp-pre-preparation-plan-and-notes. My OSCP Pre-Preparation Phase. I'm not sure if I'll be able to afford the exam but what count's trying and learning things. I'm gonna give it a try. [Start Date: 21st March 2022]

burp-uuid. UUID issues for Burp Suite

guidtool. A tool to inspect and attack version 1 GUIDs

See-SURF. Security tool to find potential vulnerable Server Side Request Forgery (SSRF) parameters.

mastg. The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

WhereToGo. WhereToGo - is a list of popular services that might be used in organizations. By having an account of the user - you can try to find entry points to the organization data.

VisaNotify-for-chrome. An Extension which notifies when a new visa appointment date is available.

telegram-image-ocr. Subscribe to Telegram messages for a user, perform OCR on the images and execute conditional triggers.

sourcegraph-scripts. Scripts for Sourcegraph search results. Useful for static analysis <3

security-study-plan. Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

awesome-ios-security. A curated list of awesome iOS application security resources.

reverse_ssh. SSH based reverse shell

cvssjs. CVSS (Common Vulnerability Scoring System) v3.1 Javascript calculator toolkit

GooglePhishing. HTML

sitepoint-docker-tutorial. Dockerfile

DNSStager. Hide your payload in DNS

awesome-list-of-secrets-in-environment-variables. 🦄🔒 Awesome list of secrets in environment variables 🖥️

puredns. Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

ChatterBot. ChatterBot is a machine learning, conversational dialog engine for creating chat bots

HuntTheBug. Advanced reconnaissance framework for bug bounty hunters - Automate subdomain enumeration, vulnerability scanning, and security reconnaissance with 30+ integrated tools.

slurp. A blazing fast & feature rich Amazon S3 bucket enumerator.

chzone. Daily dump of domains in the .ch zonefile

log4shell-analysis. Contains all my research and content produced regarding the log4shell vulnerability

CVE-2021-44228-PoC-log4j-bypass-words. 🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks

waybacked. Get URLs from the Wayback Machine. Able to handle large outputs.

htmlq. Like jq, but for HTML.

JNDI-Exploit-Kit. JNDI-Exploitation-Kit（A modified version of the great JNDI-Injection-Exploit created by @welk1n. This tool can be used to start an HTTP Server, RMI Server and LDAP Server to exploit java web apps vulnerable to JNDI Injection）

log4shell-vulnerable-app. Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

rogue-jndi. A malicious LDAP server for JNDI injection attacks

codeql-queries. My CodeQL queries collection

Log4jAttackSurface.

marshalsec. Java

writeups. Shell

github-readme-stats. :zap: Dynamically generated stats for your github readmes

mind_chess. JavaScript

openvscode-server. Run upstream VS Code on a remote machine with access through a modern web browser from any device, anywhere.

gitoops. all paths lead to clouds

gowap. Wappalyzer implementation in Go

mariana-trench. A security focused static analysis tool for Android and Java applications.

interactsh-web. Web dashboard for Interactsh client

RandomScripts. Random Shell Scripts and other ideas I have along the way

spicedb. Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

http2smugl. Go

tsunami-security-scanner-plugins. This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.

tsunami-security-scanner. Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

sdow. Six Degrees of Wikipedia