Stanislav Istyagin

Open-source security-awareness platform — build courses, run quizzes and phishing-style tests, track completion by department. No expensive SaaS or spreadsheets required.

Asynchronous recon toolkit — subdomain enumeration, port/TLS/WAF scanning, WHOIS profiling and full mail-security audit (SPF, DKIM, DMARC, MTA-STS, DNSSEC, security.txt).

🐳 COMPANY DockerHub Scanner Automated scanner for DockerHub repositories. It pulls, extracts, scans Docker images for vulnerabilities, secrets, and sensitive data. Results are presented in the terminal and exported as CSV files.

Blocks IP ranges of public Threat Intelligence scanners (Shodan, Censys, ZoomEye, FOFA, BinaryEdge) via iptables/ipset - keeps test/dev infrastructure out of internet-wide scan databases.

L0phtCrack 7 macOS fork — Apple Silicon port with hashcat engine (M1/M2/M3/M4)

CyberHeap — fast Go CLI for pentest triage of Java HPROF heap dumps. Extracts credentials, keys, tokens via regex + class-aware spiders. Decrypts Jasypt / Shiro RememberMe / JWT locally.

My wordlists

Tools & script for Cyber Forensics

Complete collection of Nuclei templates for Bitrix CMS vulnerability testing

Villain is a Windows & Linux backdoor generator and multi-session handler that allows users to connect with sibling servers (other machines running Villain) and share their backdoor sessions, handy for working as a team.

A collection of threat sources for integration into SIEM, NGFW, etc.

A Tool for Domain Flyovers

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

Privilege Escalation Enumeration Script for Windows

No description.

All PoC

An extremely effective subdomain wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4 space.

Duplicate not owned Token from Running Process

Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.

No description.