Bishop Fox ORG

Adversary Emulation Framework

Sliver is an open-source red-team framework by BishopFox that lets authorized security teams simulate real attackers, operators run a control server while a compiled implant communicates back over TLS, WireGuard, HTTPS, or DNS.

Never ever ever use pixelation as a redaction technique

A security research tool by Bishop Fox that proves pixelated text in screenshots can often be recovered, showing that pixelation is not a safe way to hide sensitive information in shared images.

Automating situational awareness for cloud penetration tests.

Extract URLs, paths, secrets, and other interesting bits from JavaScript

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

Convolutional neural network for analyzing pentest screenshots

A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

HTTP Request Smuggling over HTTP/2 Cleartext (h2c)

A collection of manifests that will create pods with elevated privileges.

Dylib injection for iOS 11.0 - 11.1.2 with LiberiOS and Electra jailbreaks

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

Utility to decrypt App Store apps on jailbroken iOS 11.x

Create your own vulnerable by design AWS penetration testing playground

RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities

Find cloud assets that no one wants exposed 🔎 ☁️

A version of Theos/CydiaSubstrate for non-jailbroken iOS devices

Search exposed EBS volumes for secrets

A ZigBee hacking toolkit by Bishop Fox

PoC code from DEF CON 25 presentation

RCE exploit for CVE-2023-3519

The Rickmote Controller: Hijack TVs using Google Chromecast

Companion labs to "An Exploration of JSON Interoperability Vulnerabilities"

Use LLMs for document ranking

Discover Exposed AI Services

No description.

A productionized greedy coordinate gradient (GCG) attack tool for large language models (LLMs)

Decrypt encrypted Fortienet FortiOS firmware images

Heavily-modified fork of David Buchanan's dlinject project. Injects arbitrary assembly (or precompiled binary) payloads directly into x86-64, x86, and ARM32 Linux processes without the use of ptrace by accessing /proc/<pid>/mem. Useful for certain post-exploitation scenarios, recovering content from process memory, etc..

Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)

Firecat is a penetration testing tool that allows you to punch reverse TCP tunnels out of a compromised network.

Safely detect whether a FortiGate SSL VPN instance is vulnerable to CVE-2023-27997 based on response timing

OSDP attack tool (and the Elvish word for friend)

Safely detect whether a FortiGate SSL VPN is vulnerable to CVE-2024-21762

Recovery of Plaintext iMessage Data Without Breaking Crypto

Anti-Anti-Automation Framework

An auxiliary spellcheck dictionary that corresponds with the Bishop Fox Cybersecurity Style Guide

Seed recovery tool for PRNGs

LLM Testing Findings Templates

Determine the running software version of a remote F5 BIG-IP management interface.

Creating attacks paths across management and data planes

Web application that lets you test if your domain is vulnerable to email spoofing

A program to map out SPF and DKIM records for a large number of domains

No description.

Scripts to clone CA certificates for use in HTTPS client attacks.

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908

Perl script to test the reliability of a list of open web proxies.

The XSS Hunter service - a portable version of XSSHunter.com

A collaborative web exploitation framework.

Proof of Concept code for CVE-2015-0345 (APSB15-07)

Decrypt encrypted SonicOSX firmware images

Curated list of public penetration test reports released by several consulting firms and academic security groups

No description.

An implementation of a vulnerable MCP server using mcp-go

A small go harness that uses Ollama to orchestrate LLMs in a restricted process flow

Go module that returns supported regions for a service or supported services for a region

Remove Offensive and Profane Words from Wordlists

Dashboard for Cirro

🔍 gowitness - a golang, web screenshot utility using Chrome Headless

No description.

No description.

Azure CLI extension for Cirro collection

Use SQL to instantly query your cloud services (AWS, Azure, GCP and more). Open source CLI. No DB required.

Docker images for the Selenium Grid Server

CLI that allows user to submit http requests using AWS request signing

No description.

An intentionally-vulnerable GWT-based web application to test tooling and techniques

Results and device code from the DEF CON 29 presentation "You're Doing IoT RNG"

Fast Go Application Scanner

Go module that provides two lookup functions for the data in https://github.com/fwdcloudsec/known_aws_accounts

No description.

Safely test Arista NGFW for information disclosure

The AWS EKS Accelerator for Terraform is a framework designed to help deploy and operate secure multi-account, multi-region AWS environments. The power of the solution is the configuration file which enables the users to provide a unique terraform state for each cluster and manage multiple clusters from one repository. This code base allows users to deploy EKS add-ons using Helm charts.

Kafka Connect Store Partitioner by custom fields and time; also removing topic from s3 file path

Silly little aws auditing project

Little tool to suss out S3 permissions as visible to the public.

Safely detect whether a PAN-OS target is vulnerable to CVE-2026-0265.

No description.

Install AWS CLI on a GitHub Actions Linux host

READONLY: Auto-generated mirror for https://github.com/marvinpinto/actions/tree/master/packages/automatic-releases

No description.

Are they tabs? Are they spaces? How many? Never wonder again!

Bishop Fox Engineering

Identify public-facing Microsoft Exchange servers and determine their software versions

Safely detect whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318

Safely detect whether a UniFi Network Application controller is vulnerable to CVE-2026-22557

Fuzzer for the Sparkplug B IIoT protocol

Detect whether a Strapi instance is vulnerable to CVE-2026-27886 (unauthenticated boolean-oracle exfiltration of administrator secrets).

No description.

Github action to sign and verify minisign/signify signatures

A GitHub action used to zip file contents

📦 :octocat: GitHub Action for creating GitHub Releases

This repo provides a terraform module for customers looking to implement Google Cloud connector support for Bishop Fox Cosmos