Ajin Abraham

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

nodejsscan is a static security code scanner for Node.js applications.

Android application fuzzing framework with fuzzers and crash monitor.

Generic SAST Library

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

CMS Scanner: Scan Wordpress, Drupal, Joomla, vBulletin websites for Security issues

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework.

Xenotix Python Keylogger for Windows.

Contents for Node.Js Security Course

Web Application Security

Static DOM XSS Scanner is a Static Analysis tool written in python that will iterate through all the JavaScript and HTML files under the given directory and will list out all the possible sources and sinks that may cause DOM XSS. At the end of the scan, the tool will generate an HTML report.

Xenotix APK Reverser is an OpenSource Android Application Package (APK) decompiler and disassembler powered by dex2jar, baksmali and jd-core.

Scripts and tools for AWS Pentest

Proof of Concepts, Exploits

Xenotix xBOT is a Cross Platform PoC Bot that abuse certain Google Services to implement it's C&C

nodejsscan Github Action

WhatsApp AutoClean is an android app that removes all WhatsApp media (images, videos, sound etc) and hide them from being shown in Gallery

Tools made for Tizen Security Analysis

Exploit Research & Development - Ported Exploits

PoC: Python package static and dynamic analysis to detect environment variable stealing

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.

A list of interesting payloads, tips and tricks for bug bounty hunters.

A sample android application implementing Moxie's Certificate Pinning Library

Tool to hook all communication APIs including XHR/XHR2, WebSockets, Web Workers, PostMessage and Server Sent Events

OpSec Firefox Addon Exploit Suite is a POC application that demonstrate various flaws in the Firefox Add-on Security Model.

OAuth Request Crafter

A simple HTTPS server that uses self signed certificate. Useful for PoC purposes

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

A vulnerable web application written in Python Flask to demonstrate insecure file extraction

🐶 A curated list of Web Security materials and resources.

Checklist of the most important security countermeasures when designing, testing, and releasing your API

An intentionally vulnerable web application written in Python using Tornado

A reverse engineering framework for iOS

usbkill waits for a change on your usb ports, then immediately kills your computer. Anti forensic, usb -> kill

AduitDroid

Chrome extension and Express server that exploits keylogging abilities of CSS.

Windows exploits, mostly precompiled.

No description.

HTTP/HTTPS proxy in a single python script

This is a multi-use bash script for Linux systems to audit wireless networks.

No description.

Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0

OpenSource tool for iCloud backup extraction

Android Reverse Engineering Framework & Toolkit

ActiveScan++ Burp Suite Plugin

Seven different DLL injection techniques in one single project.

Damn Vulnerable NodeJS Application

Python Hash Calculator

A proof-of-concept tool for reading OS X keychain passwords

Black box tool to bypass SSL verification on Android, even when pinning is used.

Simple PHP script to get browser details.

injecthtml

Tools for fingerprinting and exploiting Amazon cloud infrastructures

Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.

No description.

Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities

-An Exploit Dev Swiss Army Knife.

Static analysis tool for javascript code based. Scanjs uses Acorn to convert sources to AST, then walks AST looking for patterns.

Hooks in to interesting functions and helps reverse the web app faster.

An xposed module that disables SSL certificate checking for the purposes of auditing and app with cert pinning

Probably one of the smallest SSL MITM proxies you can make

Automated All-in-One OS Command Injection and Exploitation Tool

Secure Mobile Development - A collection of best practices

Official FuzzDB project repository

Android Dynamic Binary Instrumentation tool for tracing Android native layer

Another struts2 S2-032 vulnerability exploit

SecLists is the security tester's companion. It is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more.

A Python Framework For NoSQL Scanning and Exploitation

Automatic Server-Side Template Injection Detection and Exploitation Tool

mirror of gera's insecure programming examples | http://community.coresecurity.com/~gera/InsecureProgramming/

A small and sweet man-in-the-middle proxy capable of doing HTTP and HTTP over SSL.

Demo Application and Exploit

Some Handy Command For Network/Web Pentest

Decrypts and logs a process's SSL traffic.

A repository for learning various heap exploitation techniques.

Generates permutations, alterations and mutations of subdomains and then resolves them

A curated list of awesome Windows Exploitation resources, and shiny things. Inspired by awesom

Official Black Hat Arsenal Security Tools Repository

A open contribute bootcamp to develop DevSecOps skills...

Non-official repository for lcamtuf's American Fuzzy Lop http://lcamtuf.coredump.cx/afl/

Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.

Google Hangouts bot

In-browser code editor

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

A web scraper to retrieve application data from the Google Play Store.

The Minimalistic x86/x64 API Hooking Library for Windows

Some exploits and exploit development stuff.

TLS pinning for Java

Python version of OWASP's DirBuster Application.

HTTPLeaks

Have fun injecting SQL into a Ruby on Rails application!

An Xposed based module which is capable of hooking both Android system APIs and applications' methods.

PEDA - Python Exploit Development Assistance for GDB

A collection of web pages, vulnerable to command injection flaws.

Chrome extension for blocking x-origin cookies

Immunio's XSS Fuzzer tool

Learn from Casey Smith @subTee

Pebble App that Locates You

No description.

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

A failed attempt to prevent DOM XSS.

No description.

NoSQLi Vulnerable App

CTF Writeups

GUI for Frida -Scripts

The cheat sheet about Java Deserialization vulnerabilities

jPurify

A clean Bootstrap blog theme created by Start Bootstrap

Helper script for working with format string bugs

CTF writeups

A vulnerable version of Rails that follows the OWASP Top 10

Google Chrome, Firefox, and Thunderbird extension that lets you write email in Markdown and render it before sending.

A simple command line exe to start and debug the Microsoft Edge browser.

A shared (dynamic) library that can be transparently injected into different processes to detect memory corruption in glibc heap

DOM fuzzer

Simple session middleware for Express

Example code for changing syscall arguments using ptrace

GitHub Actions for MobSF

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).

No description.

No description.

No description.

A private messenger for iOS.

Media Server that dumps youtube playlist into mp3

Demo at PacSec2014

No description.

semgrep rules registry

No description.

Simple html and javascript files crawler

Google Voice on ZenWatch 3 crown button

Ruby library for Pusher Channels HTTP API

A simple, beautiful, and embeddable JavaScript Markdown editor. Delightful editing for beginners and experts alike. Features built-in autosaving and spell checking.

No description.

No description.

No description.

Profile

Fast and syntax-aware semantic code pattern search for many languages: like grep but for code

Care is a single point to link Hospitals, Corona Care Centers and Volunteers to the unified Corona Safe Network so that the Kerala Chief Minister's Office has direct access to live reports of health data v/s our total. healthcare capacity

Python implementation of pattern_create and pattern_offset from Metasploit Framework

An open source eCommerce plugin for WordPress.

Powerful JavaScript templates

Wiki pages about Android internals

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

Clean Blog Theme for Bolt

Class to help with adding logging function in smali output from 3rd party Android apps.

No description.

Python Process Injection PoC Code from my SteelCon talk in 2014

Minimalist examples of ES6 functionalities.

Detect unused permissions in an Android application.

the code that powers @nitcbot