Steve Stonebraker

h2spacex. HTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy‌ + Exploit Timing Attacks

noir. Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

token-saver. Content-aware output compression for AI coding assistants. Replaces blind truncation with intelligent strategies per file type: structural summaries for code, schema extraction for configs, error-focused filtering for logs, and smart sampling for CSVs. Saves tokens while preserving what the model actually needs.

burp-mcp-server. MCP server, standalone CLI, and extension orchestrator

bughunter-ai. Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault, LLM security track. Type 'hunt target.com' and let AI find the bugs.

gograbber. A horizontal and vertical web content enumerator

burp-mcp-server. Kotlin

chisel. A fast TCP/UDP tunnel over HTTP

AILab. AI Pen testing lab

claude-plugins. Intercept security for Claude Code — deep AI security scans that supplement your scanners and write findings back to the Intercept platform. OAuth 2.1, no API key.

burpparse. Go

Jailbreaking-Master-Guide.

arc_pi_taxonomy. The Arcanum Prompt Injection Taxonomy

aimap. Discover Exposed AI Services

andrej-karpathy-skills. A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.

inkwave. JavaScript

LLMtary. Autonomous AI-powered penetration testing platform. LLM-driven recon, vulnerability analysis, and exploit validation for internal & external targets. Supports local AI (Ollama, LM Studio) and cloud models (Claude, GPT-4, Gemini). Linux · macOS · Windows

gstack. Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA

Openbrowser. A browser designed for agent

dialtone. AOL Dialtone Server - Java implementation of AOL 3.0 protocol server

wiretap. AOL Protocol Wiretap Tool - Packet capture and analysis for AOL protocol reverse engineering

oh-my-kiro. Shell

garak. the LLM vulnerability scanner

adversarial-robustness-toolbox. Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

BasicBox. A 486-class PC emulator written entirely in Visual Basic 6

macdown3000. A modern, lightweight Markdown editor for macOS.

VB-Decompiler-Server. Socket Server for VB Decompiler (both Free and Pro)

OBLITERATUS. OBLITERATE THE CHAINS THAT BIND YOU

memory-palace. Persistent memory system for agentic AI via MCP - remember, recall, forget with semantic search with knowledge graph

atomforge. AtomForge: FDO compiler and decompiler with a simple web UI. Compile FDO source to binary and decompile binaries back to source. Includes hex input/output and Docker support.

configmgr-cryptderivekey-hashcat-module. Hashcat module that can crack a password used to derive an AES-128 key with CryptDeriveKey from CryptoAPI

Pentest-Everything. A collection of CTF write-ups, pentesting topics, guides and notes. Notes compiled from multiple sources and my own lab research. Topics also support OSCP, Active Directory, CRTE, eJPT and eCPPT.

Invoke-FindEventCreds. PowerShell script to parse Sysmon Event ID 1 and Security Event Log ID 4688 for command line credentials

Burp-Issue-Exporter. Burp Issue Exporter is a Burp Suite extension designed to simplify the process of exporting or copying issue details from the Scanner tab

BurpCopyIssues. Burp suite extension that lets you easily copy issues

pxethiefy. Python

Coercer. A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

Misconfiguration-Manager. Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

arsenal. Arsenal is just a quick inventory and launcher for hacking programs

Certipy. Tool for Active Directory Certificate Services enumeration and abuse

haptyc. Python

Snaffler. a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

Max. Maximizing BloodHound. Max is a good boy.

GitPhish. Python

client-side-bugs-resources. A resources for who want to learn and get deep into client-side bugs

GraphSpy. Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI

Marauder. Python

Blazor-Server-Testing-Jmeter.

mallet. Mallet is an intercepting proxy for arbitrary protocols

BridgeKeeper. Scrape, Hunt, and Transform names and usernames

misconfig-mapper. Misconfig Mapper is a fast tool to help you uncover security misconfigurations on popular third-party services used by your company and/or bug bounty targets!

certified-aws-solutions-architect-professional. AWS Certified Solutions Architect – Professional (SAP-C02) Notes

damn-vulnerable-llm-agent. Python

ReportGen. Documentation and Support for AttackForge ReportGen

Mist. A Mac utility that automatically downloads macOS Firmwares / Installers.

HExHTTP. Header Exploitation HTTP

github-secrets. This tool analyzes a given Github repository and searches for dangling or force-pushed commits containing potential secret or interesting information.

semgr8s. Semgrep-based Policy Controller for Kubernetes

doompdf. A port of Doom (1993) that runs inside a PDF file

AvaloniaVisualBasic6. A recreation of the classic Visual Basic 6 IDE and language in C# with Avalonia

MultiTapBurp. A Burp Suite extension that helps track and manage multiple sessions simultaneously by color-coding HTTP requests based on custom patterns.

CVE-2022-22965. Spring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)

follina.py. POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes

nuclei-templates. Community curated list of templates for the nuclei engine to find security vulnerabilities.

PythonCheatSheet. A Cheat Sheet 📜 to revise Python syntax. Particularly useful for solving Data Structure and Algorithmic problems with Python.

HellHall. Performing Indirect Clean Syscalls

google_RAT. A Remote Access Tool using Google Apps Script as the proxy for command and control.

fileless-elf-exec. Execute ELF files without dropping them on disk

LsassReflectDumping. This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMP_CALLBACK_INFORMATION callbacks to generate a memory dump of the cloned process

EDRSilencer. A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

DDexec. A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another.

certainly. Certainly is a offensive security toolkit to capture large amounts of traffic in various network protocols in bitflip and typosquat scenarios.

peirates. Peirates - Kubernetes Penetration Testing tool

srum-dump. A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.

CrowdStrike_RTR_Powershell_Scripts. PowerShell

nmap-parse-output. Converts/manipulates/extracts data from a Nmap scan output.

evilarc. Create tar/zip archives that can exploit directory traversal vulnerabilities

wifi-agent. :signal_strength: Rogue access point tool.

exploit-writing-for-oswe. Tips on how to write exploit scripts (faster!)

BypassFuzzer. Fuzz 401/403/404 pages for bypasses

sourcemapper. Extract JavaScript source trees from Sourcemap files

aws-s3-secret-scanner. BluBracket CLI Recipes

cli. GitHub’s official command line tool

shortscan. An IIS short filename enumeration tool

sudistark.github.io. HTML

attack-surface-detector. The Attack Surface Detector uses static code analyses to identify web app endpoints by parsing routes and identifying parameters

burp-suite-error-message-checks. Burp Suite extension to passively scan for applications revealing server error messages

bbot. The recursive internet scanner for hackers. 🧡

awesome-threat-intelligence. A curated list of Awesome Threat Intelligence resources

Bug_Bounty_Notes. A collection of notes for bug bounty hunting

OSWA. A collection of useful commands, scripts and resources for the OSWA (WEB-200) exam of Offensive Security

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

REST_in_bash. A simple REST server in Bash

mac-monitor. "The missing ProcMon for macOS": Mac Monitor records Endpoint Security events and displays them for analysis.

4n6-scripts. Forensic Scripts

falcon-helm. Helm Charts for running CrowdStrike Falcon with Kubernetes

tell-me-your-secrets. Find secrets on any machine from over 120 Different Signatures.

openvas. Containers for running the Greenbone Vulnerability Manager. Run as a single container with all services or separate single applications containers via docker-compose.

censys-cloud-connector. The Censys Unified Cloud Connector is a standalone connector that gathers assets from various cloud providers and stores them in Censys ASM. This Connector offers users the ability to supercharge our ASM Platform with total cloud visibility.

ScubaGear. Automation to assess the state of your M365 tenant against CISA's baselines

feroxbuster. A fast, simple, recursive content discovery tool written in Rust.

bocker. Docker implemented in around 100 lines of bash

DccwBypassUAC. Windows 8.1 and 10 UAC bypass abusing WinSxS in "dccw.exe".

Freeze. Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy. Java Android Magisk Burp Objection Root Emulator Easy (JAMBOREE)

bypass-403. A simple script just made for self use for bypassing 403

httpx. httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

rescope. Bugbounty scope tool

awesome-censys-queries. A collection of fascinating and bizarre Censys Search Queries

anew. A tool for adding new lines to files, skipping duplicates

ultimate-nmap-parser. parse nmap files

wpLockPicker. A CLI tool used for bruteforcing WordPress by exploiting the XMLRPC interfaces.

GBucketDump. Tool for enumerating and exploring data in Google Storage Buckets

ptf. The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.

goGetBucket. A penetration testing tool to enumerate and analyse Amazon S3 Buckets owned by a domain.

AWS. Shell

hibp-downloader. Download all the HIBP passwords

dispatch-docker. Shell

ArchiveBot. ArchiveBot, an IRC bot for archiving websites

ProgzRescue. Repository to help with archival and recovery of AOL Progs from the 1990s

the-book-of-secret-knowledge. A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

DeepFaceLive. Real-time face swap for PC streaming or video calls

aolunderground-proggies. Visual Basic Source Code and Proggies/Progz for AOL Instant Messenger (AIM) and America Online (AOL). Aohell, Fatex, punters, bas files, etc.

iot. Resources for IoT security research

waymore. Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan, VirusTotal, GhostArchive & Intelligence X!

PhishingTemplates. This is a collection of phishing templates and a landing page to be used with goPhish

chatter. internet monitoring osint telegram bot for windows

smogcloud. Find cloud assets that no one wants exposed 🔎 ☁️

aws_public_ips. Fetch all public IP addresses tied to your AWS account. Works with IPv4/IPv6, Classic/VPC networking, and across all AWS services

ThreatMapper. Open Source Cloud Native Application Protection Platform (CNAPP)

ssl_logger. Decrypts and logs a process's SSL traffic.

container-security-checklist. Checklist for container security - devsecops practices

red-detector. Scan your EC2 instance to find its vulnerabilities using Vuls (https://vuls.io/en/)

red-shadow. Lightspin AWS IAM Vulnerability Scanner

xvs-mvc-bb-a1up. X-men vs Street Fighter/Marvel-vs-Capcom/Big Blue/Yoga Flame/Shinkuu Arcade 1Up Software Modding Resources

osmedeus. A Modern Orchestration Engine for Security

jaeles. The Swiss Army knife for automated Web Application Testing

unfurl. Pull out bits of URLs provided on stdin

metabigor. OSINT tools and more but without API key

warhorse. Infrastructure Automation

inceptor. Template-Driven AV/EDR Evasion Framework

IOSSecuritySuite. iOS platform security & anti-tampering Swift library

Fenrir. Simple Bash IOC Scanner

Crescendo. Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.

OSXMon. OSX Events Monitor

peacemakr-cli. CLI for Peacemakr's Secure Data Platform (Dockerhub: https://hub.docker.com/r/peacemakr/peacemakr-cli )

Pentest-Tools-Framework. Pentest Tools Framework is a database of exploits, Scanners and tools for penetration testing. Pentest is a powerful framework includes a lot of tools for beginners. You can explore kernel vulnerabilities, network vulnerabilities

Ninja. Open source C2 server created for stealth red team operations

devreorder. A utility for reordering and hiding DirectInput controllers

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

evilginx. PLEASE USE NEW VERSION: https://github.com/kgretzky/evilginx2

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Bloodhound-Portable. Bloodhound Portable for Windows

td. Your todo list in your terminal

palo-xdr-testing. Batchfile

caldera. Automated Adversary Emulation Platform

pwncat. Fancy reverse and bind shell handler

attack_range. A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

npm-initial-access. Easy to extend initial access scenario to help with EDR testing on Linux and Mac

threat-tools. Tools for simulating threats

laurel. Transform Linux Audit logs for SIEM usage

auditd-attack. A Linux Auditd rule set mapped to MITRE's Attack Framework

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

PENTESTING-BIBLE. articles

PoC-in-GitHub. 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

HackTools. The all-in-one browser extension for offensive security professionals 🛠

gimme-aws-creds. A CLI that utilizes Okta IdP via SAML to acquire temporary AWS credentials

poc. Proof of Concepts

cilium. eBPF-based Networking, Security, and Observability

ghhdb-Github-Hacking-Database. Github Hacking Database - My personal collection of Github Dorks to search for Confidential Information (Yes, it's a Github version of Google Dorks)

imdsv2_wall_of_shame. List of vendors that do not allow IMDSv2 enforcement

Spotlight. A Super Mario 3D World Level Editor using the GL_EditorFramework

nginx-honeypot. NGINX honeypot with lots of honey

RdpGamepad. Remote Desktop Plugin for Xbox Gamepads

LogMePwn. A fully automated, reliable, super-fast, scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability.

arcade1up-mods. Mods for arcade1up cabinet

log4j-cve-2021-44228. Log4j CVE-2021-44228 examples: Remote Code Execution (through LDAP, RMI, ...), Forced DNS queries, ...

log4jcheck. A script that checks for vulnerable Log4j (CVE-2021-44228) systems using injection of the payload in common HTTP headers.

log4shell-vulnerable-app. Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

log4j-scan. A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

log4j-scan-turbo. Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers.

S3-Listable. S3 Buckets that will let you list all files inside them

Fast-Google-Dorks-Scan. The OSINT project, the main idea of which is to collect all the possible Google dorks search combinations and to find the information about the specific web-site: common admin panels, the widespread file types and path traversal. The 100% automated.

eb-ssm. SSH into an AWS Elastic Beanstalk environment instance using AWS Systems Manager Agent. This removes the need to configure and share private keys on Elastic Beanstalk instances.

tfwriter. Terraform HCL code generator.

prismacloud_terraform_w_modules. HCL

aws-remote. AWS Remote is a command line tool to view and interact with AWS instances via SSM

ivre. Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

terraform-aws-secure-baseline. Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.

AIL-framework. AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project

awesome-nmap-grep. Awesome Nmap Grep

ScanCannon. A script for credentials-based attack surface enumeration and general reconnaissance of massive external networks

terraform-aws-ecs-web-app. Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more.

slack-export. A python slack exporter

cloud_enum. Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

terraform-ecs. AWS ECS terraform module

minikube. Run Kubernetes locally

open-source-mac-os-apps. 🚀 Awesome list of open source applications for macOS. https://t.me/s/opensourcemacosapps

Zettlr. Your One-Stop Publication Workbench

smokescreen. A simple HTTP proxy that fogs over naughty URLs