Uscrapper Introducing Uscrapper 2.0, A powerful OSINT web scrapper that allows users to extract various personal information from a website. It leverages web scraping techniques and regular expressions to extract email addresses, social media...
codetotal CodeTotal analyzes any snippet, file, or repository to detect possible security flaws such as secret in code, open source vulnerability, code security, vulnerability, insecure infrastructure as code, and potential legal issues with open source licenses. Scan repository Scan an entire repository Scan snippets Copy-paste a snippet in...
CloudRecon CloudRecon is a suite of tools for red teamers and bug hunters to find ephemeral and development assets in their campaigns and hunts. Often, target organizations stand up cloud infrastructure that is not...
EasyEASM Easy EASM is just that… the easiest to set up tool to give your organization visibility into its external facing assets. The industry is dominated by $30k vendors selling “Attack Surface Management,” but...
Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility (http, https) Login panel scanning is done in multiprocessing Installation git...
Bugsy Bugsy is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code. It is the community edition version of Mobb, the first vendor-agnostic automated security vulnerability remediation tool. Bugsy is...
Nekuda – IDN-Squatting Detector Domain Lookalikes A domain lookalike is a domain name that is similar to a legitimate domain name but with slight differences. These differences can be in the spelling of the...
WebCopilot WebCopilot is an automation tool designed to enumerate subdomains of the target and detect vulnerabilities using different open-source tools. The script first enumerates all the subdomains of the given target domain using assetfinder,...
CHOMTE.SH CHOMTE.SH is a versatile framework designed for automating reconnaissance tasks in penetration testing. It’s useful for bug bounty hunters and penetration testers in both internal and external network engagements. Its key features include...
navgix navgix is a multi-threaded golang tool that will check for nginx alias traversal vulnerabilities. Techniques Currently, navgix supports 2 techniques for finding vulnerable directories (or location aliases). Those are the following: Heuristics navgix...
Argus This repo contains the code for our USENIX Security ’23 paper “ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions”. Argus is a comprehensive security analysis tool specifically designed...
BucketLoot BucketLoot is an automated S3-compatible Bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning...
CVE-2023-44487 Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487. This tool checks to see if a website is vulnerable to CVE-2023-44487 completely non-invasively. The tool checks if a web...
route-detect Find authentication (authn) and authorization (authz) security bugs in web application routes: Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard...
IAMActionHunter IAMActionHunter is an IAM policy statement parser and query tool that aims to simplify the process of collecting and understanding permission policy statements for users and roles in AWS Identity and Access Management...
Secure Your Connection
