Robin Wood

Damn Vulnerable Web Application (DVWA)

DVWA (Damn Vulnerable Web Application) is an intentionally insecure PHP app for practicing common web attack techniques legally and safely on a private machine, never on a public server.

CeWL is a Custom Word List Generator

Pipal, THE password analyser

RSMangler will take a wordlist and perform various manipulations on it similar to those done by John the Ripper with a few extras.

A lab for playing with NoSQL Injection

A tool for searching a Git repository for interesting content

A lab to play with authentication and authorisation problems

A collection of tools to find data that has been made public in cloud storage systems such as S3 Buckets and Digital Ocean Spaces

A vulnerable LDAP based web app written in Golang

A repo which contains lots of things which it shouldn't

A list of user agents belonging to common web scanners.

Fingerprint a web app using local files as the fingerprint sources

Twitter Words of Interest - Generate word lists from twitter searches

Defending against XSS in SVG files

RSYaba Modular Brute Force Attacker

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

A set of scripts to help automate the management of Burp Collaborator

A port scanner written in PowerShell

Pat to Pass - Convert observed key presses to potential password lists

Take a word list and convert 1337 spellings back to normal

A script to run with mitmproxy to inject a bearer token into every request.

A very simple lab for cracking Flask session cookies

Learning to build web apps in Gin. Don't expect anything new or ground breaking, I'm just following tutorials.

A lab to play with web cache poisoning

Extension for Burp to automatically save images to a file.

My practice Go files

Proof of concept code to go with my OTS Certificate blog post

Suggest common typos to a given domain name which could be in use by typo squatters

E-mail, subdomain and people names harvester

Nikto web server scanner

Learning and playing with Ethereum Smart Contracts

Nmap - the Network Mapper. Github mirror of official SVN repository.

A lab for security testing web sockets

The source-code for: "Build a Blockchain from Scratch in Go" eBook.

Testing TLS/SSL encryption anywhere on any port

Using GitHub and CDNs to bypass a CSP

DNS Enumeration Script

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec (v2, v3)

Screenshot Shenanigans

Metasploit Framework

All about me!

Source code for the DVWA homepage.

Take an XML sitemap and request all the URLs in it through your chosen proxy.

Bambdas collection for Burp Suite Professional and Community.

No description.

This is an attempt to footprint all the trackers and profiling attempts used by numerous UK newspapers operating online, papers known for being liberal with the truth. It is a work in progress and the trackers listed here can also apply to other aspects of the web we use today.

A test for October CMS to see if Apache is setup correctly

Lookup the MS severity for a given KB

A highly extensible Git implementation in pure Go.

Malware execution environment

Scripts to extract files from SCM directories left on web servers

A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

Scaling Network Scanning

No description.

Kubernetes website and documentation repo:

Forking a bogus vulnerability report

An Open Letter to the OWASP Board

The AWS Lambda Developer Guide

Swagger Editor

Application Security Verification Standard

Exercise 3

No description.

SAML library for go

Revel manual and docs

Assists in mass exportation of Nessus scans