l1nk3r

flounder. Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification.

audit-skills. 专注于代码审计skill，最小化轻量化skill，只负责安全边界。

DeepAudit. DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

mootdx. 通达信数据读取的一个简便使用封装

Kronos. Kronos: A Foundation Model for the Language of Financial Markets

TradingAgents-CN. 基于多智能体LLM的中文金融交易框架 - TradingAgents中文增强版

TradingAgents-crypto. TradingAgents-crypto : Multi-Agent LLM Cryptocurrency Trading Framework

Code-Review-GPT-Gitlab. 🤖 GPT（ Deepseek and more ） Code Review for Gitlab （针对于 Gitlab 的 LLM 辅助 Code Review 工具）项目详细文档 👇🏻

AI-Codereview-Gitlab. 基于大模型(DeepSeek,OpenAI等)的 GitLab 自动代码审查工具；支持钉钉/企业微信/飞书推送消息和生成日报；支持Docker部署；可视化 Dashboard。

CaA. CaA - Collector and Analyzer, Insight into information, exploring with intelligence in a thousand ways. 信息洞察，智探千方！

kscan. Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。

ARL-Finger-ADD. 灯塔（最新版）指纹添加脚本！

nuclei-plus. Functional enhancement based on nuclei. 基于 nuclei 的功能增强。

ultimaste-nuclei-templates. 极致攻防实验室 nuclei 检测 POC

NucleiTP. 自动整合全网Nuclei的漏洞POC，实时同步更新最新POC！

watchvuln. 一个高价值漏洞采集与推送服务 | Collect valueable vulnerabilities and push them to various services

extractor-java. CodeQL extractor for java, which don't need to compile java source

CodeQLpy. CodeQLpy是一款基于CodeQL实现的半自动化代码审计工具，目前仅支持java语言。实现从源码反编译，数据库生成，脆弱性发现的全过程，可以辅助代码审计人员快速定位源码可能存在的漏洞。

suo5. 高性能 HTTP 正向代理工具 | A high-performance http tunneling tool

tabby. A CAT called tabby ( Code Analysis Tool )

copy-cert. 本工具可以基于已知网站 ssl 证书的信息生成新的自签名证书，保持签发者、有效期、序列号、域名等一致，用于伪装流量。

spoon. Spoon is a metaprogramming library to analyze and transform Java source code. :spoon: is made with :heart:, :beers: and :sparkles:. It parses source files to build a well-designed AST with powerful analysis and transformation API.

java-xxe-defense-demo. java xxe defense demo

CDK. 📦 Make security testing of K8s, Docker, and Containerd easier.

RedTeamTools. 记录自己编写、修改的部分工具

sign. 逆向app参数的思路和体验，安卓逆向

Thief. 一款创新跨平台摸鱼神器，支持小说、股票、网页、视频、直播、PDF、游戏等摸鱼模式，为上班族打造的上班必备神器，使用此软件可以让上班倍感轻松，远离 ICU。

rwctf-2021-old-system. Dockerfile

k8s-security. Kubernetes security notes and best practices

Web-Fuzzing-Box. Web Fuzzing Box - Web 模糊测试字典与一些Payloads

Static-Program-Analysis-Book. Getting started with static program analysis. 静态程序分析入门教程。

BurpFastJsonScan. 一款基于BurpSuite的被动式FastJson检测插件

redteam_vul. 红队作战中比较常遇到的一些重点系统漏洞整理。

EHole. EHole(棱洞)-红队重点攻击系统指纹探测工具

privacy. 个人隐私泄露检测工具。

shanghai_house_knowledge. 2020年11月在上海买房经历总结出来的买房购房做的一些功课分享给大家，技术人帮助技术人，希望对大家有所帮助。

alicloud-tools. 阿里云ECS、策略组辅助小工具

fscan. 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

Packer-Fuzzer. Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

gohttpserver. The best HTTP Static File Server, write with golang+vue

Apache-Solr-RCE. Apache Solr Exploits 🌟

attackRmi. attackRmi

momo-code-sec-inspector-java. IDEA静态代码安全审计及漏洞一键修复插件

OSSTunnel. 基于亚马逊S3\阿里云OSS\腾讯COS通信隧道的远程管理工具

SB-Actuator. Spring Boot Actuator未授权访问【XXE、RCE】单/多目标检测

xray-crack. xray社区高级版证书生成，仅供学习研究，正常使用请支持正版。removed due to Chaitin requirements & support to version 1.4.4 & learning purpose

AntSword-JSP-Template. Java

HackBrowserData. Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

copagent. java memory web shell extracting tool

jre8u20_gadget. jre8u20 gadget

CVE-2020-15148-bypasses. 几条关于CVE-2020-15148（yii2反序列化）的绕过

h2csmuggler. HTTP Request Smuggling over HTTP/2 Cleartext (h2c)

spring-view-manipulation. When MVC magic turns black

Frog-Submon. 🐸Subdomain Monitor, 子域名监控

JavaEETest. Spring、SpringMVC、MyBatis、Spring Boot案例

behinder_source. Behinder3.0 Beta4 源码（Decompile and Fixed）

Godzilla. 哥斯拉

SpringBootVulExploit. SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list

Awesome-CobaltStrike. List of Awesome CobaltStrike Resources

TLS-poison. Rust

ShiroRce-Burp. Java

Java-Rce-Echo. Java RCE 回显测试代码

pystinger. Bypass firewall for traffic forwarding using webshell

BadPotato. Windows 权限提升 BadPotato

AllThingsSSRF. This is a collection of writeups, cheatsheets, videos, books related to SSRF in one single location

Golang-100-Days. Golang - 100天从新手到大师

JavaThings. Share Things Related to Java - Java安全漫谈笔记相关内容

CVE-2020-5902. CVE-2020-5902 BIG-IP

codeql. GitHub Satellite 2020 workshops on finding security vulnerabilities with CodeQL for Java/JavaScript.

MySQL_Fake_Server. MySQL Fake Server use to help MySQL Client File Reading and JDBC Client Java Deserialize

ZY-Player. ▶️ 跨平台桌面端视频资源播放器.简洁无广告.免费高颜值. 🎞

frida-dexdump. A frida tool to dump dex in memory to support security engineers analyzing malware.

notsoserial. Java Agent which mitigates deserialisation attacks by making certain classes unserializable

SpringBoot-Labs. 一个涵盖六个专栏：Spring Boot 2.X、Spring Cloud、Spring Cloud Alibaba、Dubbo、分布式消息队列、分布式事务的仓库。希望胖友小手一抖，右上角来个 Star，感恩 1024

cafecompare. Java code comparison tool (jar / class)

threadtear. Multifunctional java deobfuscation tool suite

fanqiang. 翻墙-科学上网

awesome-jenkins-rce-2019. There is no pre-auth RCE in Jenkins since May 2017, but this is the one!

java_rasp_example. Java

vulfocus. 🚀Vulfocus 是一个漏洞集成平台，将漏洞环境 docker 镜像，放入即可使用，开箱即用。

java-object-searcher. java内存对象搜索辅助工具

wsltools. Web Scan Lazy Tools - Python Package

TrustMeAlready. 🔓 Disable SSL verification and pinning on Android, system-wide

javasec. 自己学习java安全的一些总结，主要是安全审计相关

ToolAnalysisResultSheet. Tool Analysis Result Sheet

vscode-codeql. An extension for Visual Studio Code that adds rich language support for CodeQL

fuxi. Penetration Testing Platform

CVE-2020-0796. CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

RL-Stock. 📈 如何用深度强化学习自动炒股

gin-doc-cn. go 语言框架 gin 的中文文档

JspMaster-Deprecated. 一款基于webshell命令执行功能实现的GUI webshell管理工具，支持流量加密

core. 🔞 JAVClub - 让你的大姐姐不再走丢

CVE-2020-0796-PoC. PoC for triggering buffer overflow via CVE-2020-0796

PyC2-demo. 从入门到放弃的产物，学习过程中用python实现的一个单点c2基本功能

BypassShell. anti AV

CVE-2020-2551. how detect CVE-2020-2551 poc exploit python Weblogic RCE with IIOP

Hades. Static code auditing system

dumpDex. 💯一款Android脱壳工具，需要xposed支持, 易开发已集成该项目。

inql. InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

Fugu. Fugu is the first open source jailbreak based on the checkm8 exploit

WeChatExtension-ForMac. A plugin for Mac WeChat

cve-2020-0688. cve-2020-0688

cve-2020-0688. cve-2020-0688

after-deserialization-attack. Java After-Deserialization Attack

31-days-of-API-Security-Tips. This challenge is Inon Shkedy's 31 days API Security Tips.

CVE-2020-8813. The official exploit for Cacti v1.2.8 Remote Code Execution CVE-2020-8813

bayonet. bayonet是一款src资产管理系统，从子域名、端口服务、漏洞、爬虫等一体化的资产管理系统

ajpfuzzer. A command-line fuzzer for the Apache JServ Protocol (ajp13)

GadgetProbe. Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

memShell. a webshell resides in the memory of java web server

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

learnjavabug. Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

deserialization-filter-blacklists. Native Java serialization filter blacklist for common gadgets

JSINFO-SCAN. 递归式寻找域名和api。

geye. 🚀Faster Github Monitor🚀

crawlab. Distributed web crawler admin platform for spiders management regardless of languages and frameworks. 分布式爬虫管理平台，支持任何语言和框架

ATTCK-PenTester-Book. ATTCK-PenTester-Book

DarkNet_ChineseTrading. 🚇暗网中文网监控爬虫(DEEPMIX)

JRE8u20_RCE_Gadget. JRE8u20_RCE_Gadget

advisories. Atredis Partners Security Advisories

AssetScan. 资产探测工具，检测存活，检测风险端口，常规端口，全端口探测等等，对探测的端口的脆弱面进行安全分析进行

SRC-experience. 工欲善其事，必先利其器

BypassAntiVirus. 远控免杀系列文章及配套工具，汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术，并对免杀效果进行了一一测试，为远控的免杀和杀软对抗免杀提供参考。

http-request-smuggler. Java

wuhan2020. 新型冠状病毒防疫信息收集平台

bounty-targets-data. This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

dnsAutoRebinding. ssrf、ssrfIntranetFuzz、dnsRebinding、recordEncode、dnsPoisoning、Support ipv4/ipv6

build-web-application-with-golang. A golang ebook intro how to build a web with golang

Decrypt_Weblogic_Password. 搜集了市面上绝大部分weblogic解密方式，整理了7种解密weblogic的方法及响应工具。

vulnerable-node. A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the quality of security analyzers tools tools

scanner-cli. A project security/vulnerability/risk scanning tool

dvna. Damn Vulnerable NodeJS Application

Vulnerability-goapp. Web application build Golang with Vulnerability

hunter. Hunter作为中通DevSecOps闭环方案中的一环，扮演着很重要的角色，开源之后希望能帮助到更多企业。

spring-boot-actuator-h2-rce. Sample Spring Boot App Demonstrating RCE via Exposed env Actuator and H2 Database

CVE-2020-5398. CVE-2020-5398 - RFD(Reflected File Download) Attack for Spring MVC

chainoffools. A PoC for CVE-2020-0601

CurveBall. PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)

weblogic-JMX-monitoring. Presents in detail how to access WebLogic MBeans through JMX clients

SerialKiller. Look-Ahead Java Deserialization Library

rmi-jndi-ldap-jrmp-jmx-jms. rmi、jndi、ldap、jrmp、jmx、jms一些demo测试

cve-2019-19781. This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.

gadgetinspector. 一个利用ASM对字节码进行污点传播分析的静态代码审计应用（添加了大量代码注释，适合大家进行源码学习）。也加入了挖掘Fastjson反序列化gadget chains和SQLInject（JdbcTemplate、MyBatis、JPA、Hibernate、原生jdbc等）静态检测功能。并且加入了很多功能以方便进行漏洞自动化挖掘。

SharpDecryptPwd. 对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。源码：https://github.com/RowTeam/SharpDecryptPwd

CVE-2019-19781. Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]

shiro_rce_tool. shiro 反序列 命令执行辅助检测工具

CVE-2019-10758. JavaScript

best-windows-apps. 推荐好用、优秀的 Windows 应用

crawlergo_x_XRAY. 360/0Kee-Team/crawlergo动态爬虫结合长亭XRAY扫描器的被动扫描功能

crawlergo. A powerful browser crawler for web vulnerability scanners

JNDI-Injection-Exploit. JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Jackson,Fastjson,etc）

Enterprise-Security-Skill. 用于记录企业安全规划，建设，运营，攻防的相关资源

Coeus. Android apk/sdk Scan包括android apk/sdk 安全审计代码扫描以及国内政策扫描

jdbc-backdoor. A fake JDBC driver that allows OS command execution.

AirDoS. 💣 Remotely render any nearby iPhone or iPad unusable with an AirDrop exploit (now patched)

sec-tool-list. More than 21K security related open source tools, sorted by star count. Both in markdown and json format.

java_xxe_2019. 总结了一下2019年在JVM环境中使用XXE攻击的知识

UAC_Bypass_In_The_Wild. Windows 10 UAC bypass for all executable files which are autoelevate true .

CVE-2019-11708. Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

JavaCodeAudit. Getting started with java code auditing 代码审计入门的小项目

HTTP-Smuggling-Lab. Use HTTP Smuggling Lab to learn HTTP Smuggling.

jrdwp. Java Remote Debug through Websocket Proxy.

SerialKillerBypassGadgetCollection. Collection of bypass gadgets to extend and wrap ysoserial payloads

marp-cli. A CLI interface for Marp and Marpit based converters

docs4dev. 后端开发常用框架文档及中文翻译，包含 Spring 系列文档（Spring, Spring Boot, Spring Cloud, Spring Security, Spring Session），大数据（Apache Hive, HBase, Apache Flume），日志（Log4j2, Logback），Http Server（NGINX，Apache），Python，数据库（OpenTSDB，MySQL，PostgreSQL）等最新官方文档以及对应的中文翻译。

RdpThief. Extracting Clear Text Passwords from mstsc.exe using API Hooking.

hoppscotch. Open-Source API Development Ecosystem • https://hoppscotch.io • Offline, On-Prem & Cloud • Web, Desktop & CLI • Open-Source Alternative to Postman, Insomnia

biu. 网络资产攻击面梳理

GoSSIP_Blog. 每周定期更新论文笔记分享的markdown以及图片

xxer. A blind XXE injection callback handler. Uses HTTP and FTP to extract information. Originally written in Ruby by ONsec-Lab.

c-jwt-cracker. JWT brute force cracker written in C

mjet. MOGWAI LABS JMX exploitation toolkit

shiro_rce_exp. Shiro RCE (Padding Oracle Attack)

LangSrcCurise. SRC子域名资产监控

COMahawk. Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322

web-frontend-magic. #前端黑魔法# 整理

xss-cheatsheet-data. This repository contains all the XSS cheatsheet data to allow contributions from the community.

javaserializetools. Java反序列化漏洞利用工具V1.0 Java反序列化相关漏洞的检查工具，采用JDK 1.8+NetBeans8.2开发，软件运行必须安装JDK 1.8或者以上版本。 支持：weblogic xml反序列化漏洞 CVE-2017-10271/CNVD-C-2019-48814/CVE-2019-2725检查。

rogue-jndi. A malicious LDAP server for JNDI injection attacks

spy-debugger. 微信调试，各种WebView样式调试、手机浏览器的页面真机调试。便捷的远程调试手机页面、抓包工具，支持：HTTP/HTTPS，无需USB连接设备。

adaudit. Powershell script to do domain auditing automation

Ladon. Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP)或方法快速获取目标网络存活主机IP、计算机名、工作组、共享资源、网卡地址、操作系统版本、网站、子域名、中间件、开放服务、路由器、交换机、数据库、打印机等，大量高危漏洞检测模块MS17010、Zimbra、Exchange

nsfocus-rsas-knowledge-base. 绿盟科技漏洞扫描器(RSAS)漏洞库

.NET_study. 跟.net相关的学习

Security-Data-Analysis-and-Visualization. 2018-2020青年安全圈-活跃技术博主/博客

dnstunnel. dns tunnel backdoor DNS隧道后门

defusedxml. Python

Fortify. 源代码漏洞の审计

WatchAD. AD Security Intrusion Detection System

phuip-fpizdam. Exploit for CVE-2019-11043

springboot-guide. SpringBoot2.0+从入门到实战！

bcc. BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

SerializationDumper. A tool to dump Java serialization streams in a more human readable form.

EBurst. 这个脚本主要提供对Exchange邮件服务器的账户爆破功能，集成了现有主流接口的爆破方式。

Spring-Boot-Actuator-Exploit. Spring Boot Actuator (jolokia) XXE/RCE

burpFakeIP. 服务端配置错误情况下用于伪造ip地址进行测试的Burp Suite插件

Joomla-3.4.6-RCE. Joomla 3.4.6 – Remote Code Execution

sentinel-scanner. Next Generation Distributed Web Security Scanner with Futuristic Architecture and UI :dizzy: 混沌守望者（扫描器），多策略（爬虫扫描&POC 扫描）、模块化、分布式的智能网络空间测绘、管理与安全探测

exploits. Pwn stuff.

spring-analysis. Spring源码阅读