Hanno Böck

snallygaster. Tool to scan for secret files on HTTP servers

bashcheck. test script for shellshocker and related vulnerabilities

php-crashers. Example scripts that cause segfaults in PHP

vulns. Named vulnerabilities and their practical impact

meltdownspectre-patches. Summary of the patch status for Meltdown / Spectre

vacdec. Python script to decode the EU Covid-19 vaccine certificate

optionsbleed. Python

tlshelpers. A collection of scripts that help handling X.509 certificate and TLS issues

smtpsmug. Python

tls-what-can-go-wrong. TLS - what can go wrong?

hpkp. HTTP Public Key Pinning (HPKP) pin generation tools

apache-uaf. Apache use after free bug infos / ASAN stack traces

superfishy. Archive of software and other data involved in the Superfish / Komodia incident

fpmvuln. bash poc scripts to exploit open fpm ports

lecaa. Check for Let's Encrypt CAA issue

hackercon. List of Free Software and IT Security related conferences

bignum-fuzz. Code to fuzz bignum libraries

selftls. Sample application to let OpenSSL talk to itself (for fuzzing)

pgpecosystem. Scripts to parse and analyze pgp key server data

com2txt. com2txt tool (from 1993)

zipeinfo. ZIP encryption info

alphasecret. Find PNG files with suspicious data in alpha channel

ctgrab. Shell

pgpbugs. A history of PGP-related vulnerabilities

ed25519hetzner. Script to scan OpenSSH host key and known_hosts files for shared keys from server hoster Hetzner

mmapfail. Simple shell script to detect bad checks of mmap() return value

pwncloud. proof of concept to backdoor files from owncloud encryption module

svnscraper. bash script to download publicly available .svn directories

libfuzzer-examples. examples for libfuzzer

secpw. Secure random passwords in Javascript

ipmx. Python

badocspcert. Check for certs affected by July 2020 OCSP intermediate incident

jitsivuln. Check for jitis meet default password vulnerability

uudeview. Decoder and encoder for Base64 (MIME), uuencoded, xxencoded and Binhex files.

primecheck. Check Diffie Hellman group prime parameter

httpstime. Setting the system time over HTTPS

pypi-bad. Bad packages from the pypi repository

webminex. poc exploit for webmin backdoor (CVE-2019-15107 and CVE-2019-15231)

emailprotocols. An overview of E-Mail protocols and data formats

mbox2maildir. Script to convert between mbox and maildir format

asantoo. Overlay to use Gentoo with Address Sanitizer

rpter. Parse mails with reports from DMARC and SMTP TLS Reporting

silic. silic - simple link checker written in python

tmobile-login. Trivial bash script to log into Telekom / T-Mobile wireless lan

fritzbox-keys. private keys found on AVM Fritz!Box firmware images

rompager-check. Online and offline check tool for the RomPager HTTP server and vulnerable versions

geogrep. Find images by geo coordinate proximity

forti. Info on 2025 Fortinet/Fortigate leak

xssgame. PHP

exif2osm. Convert JPEG exif geotags to link on openstreetmap.org

crimesafe-csrf. Create CSRF tokens secure from compression attacks like CRIME/BREACH/TIME/HEIST

svgx. Shell script chaining various SVG optimization tools

rdrand-test. Testing the rdrand CPU instruction

rosproject-scripts. Scripts to compile ROS packages with compiler sanitizers

courier-libs. Courier Mail Server - shared libraries

alwaysdns. Python