GainSec ORG

Hardware hacker’s flying probe automation stack for agent-driven target discovery, microscope mapping, safety-monitored CNC motion, probe review, and controlled pin probing.

Burp Extension for easily creating Wordlists

Independent research white paper by Jon “GainSec” Gaines examining the security posture of a connected public safety technology ecosystem.

Wordlist for Hacking, Penetration Testing, Vulnerability Assessments and More

Custom firmware for the M5NanoC6 (ESP32-C6) meant to sniff and alert you of nearby Flock Safety devices. Will be integrated into a exploit tool releasing on 09/27/25 for Flock Safety devices!

An all-in-one Shodan & ZoomEye supported tool to search, browse, preview and dump data leakage across 20+ services. Pulls real exposure straight from the sources instead of guessing. Drop it into your workflow and watch it surface leaks you won't find anywhere else.

CLI and Web App to automatically format dorks for all major search engines

A web-based theme editor for the Hak5 WiFi Pineapple Pager. Create, customize, and export themes without needing to manually edit JSON files or manage image assets. By GainSec

High level attack and finding maps for all your penetration testing, hacking, bug bounty and red teaming needs!

Implementation of Man-in-the-Middle (MiTM) Router / Access Point (AP). Great for embedded, IoT, or simlar penetration tests, hacks or research. Creates all interfaces and configurations on the fly, integrates other functionality to make tls stripping, android use or burp suite use more streamlined.

Notes, custom scripts, workflows, etc from doing AI research / prototyping a local stack.

A macOS application for testing and experimenting with Apple's on-device Foundation Models (Apple Intelligence). Build custom prompts, create multi-step pipelines, and analyze response consistency, all running locally on your Mac with no cloud dependencies.

GainSec published Whitepaper covering wireless attacks in regards to automobiles.

Self-hosted workbench host for AI coding agents. Each project gets a themed dashboard where the agent drops approval forms, runbooks, files, and review docs — out-of-band from chat, persistent, auditable. FastAPI + Svelte 5, single static binary or Docker, single-user.

M5Stack M5NanoC6 Zigbee Sniffer instructions.

A complete tutorial for setting up CloudGoat using Windows 10 and Virtual Box (Ubuntu Server 20.04 LTS)

Quick script to automate some basic tasks done during a OSX Thick Client or Software Penetration Test. Checks for things like ARC, PIE, Canary, Codesignature Flags, NSFileProtect, Signature and more.

BRA Slim — free tier of Battle Ready Armor. AI-augmented security assessment, governed end-to-end. The operator drives; an LLM agent runs recon, captures evidence, drafts findings, and writes the report — every action gated, anonymized, and recorded by a governance layer the operator owns.

Proof of Concept (PoC) for CVE: 2017-16744 and 2017-16748

Some notes/materials about reverse engineering the Little Tikes Dream Machine.

M5Stack 'Paxcounter' without the LoRA functionality. Lists number of nearby WiFi and Bluetooth Devices.

TensorFlow Generic Harness: a self-contained replay toolkit that runs OEM-style YOLO/SSD TensorFlow Lite models against live webcams, recorded footage, or extracted session directories, mirroring device pipelines with JSON reporting, session markers, and Docker/ venv automation. BYO model assets

Weaponized the Mousejack and Keysniff Vulnerabilities

Basic List of Google Dorks [Incomplete]

Proper firehose to interact with Flock Safety's License Plate Readers when in EDL mode.

Raw output, logs and other files related to my V2X Paper published in Phrack 72.

Quick Script to create a Engagement Root and Data Directory Structure for penetration testing or other types of offensive cyber security engagements

Crt.sh Passive Enumeration Script compatiable with OSX

Instagram Clone for use in labs. Can be used for researching, testing, prototyping, tracking.

A macOS app for testing Apple's Image Playground API with enhanced features beyond the stock Image Playground app.

Find leaked emails with your passwords. demo:

Direct offensive workflows through a controlled command interface built for operators, pentesters, hackers and cybersecurity professionals. Made by GainSec

SectorMap is a self-hosted, offline-first dataset browser and archive platform with a galaxy-style interface, SQLite storage, Docker deployment, CSV import/export, and multi-database support. Supports desktop and mobile web plus a native iOS app

Agent Ready Armor (ARA) — a runtime substrate for AI agents. Containment for what agents do, provenance for what they produce. Built for the demands of offensive security, applicable to any agentic deployment. Second in the Ready Armor Suite, after BRA. Control in Depth.

Public preview of Battle Ready Armor (BRA): an agentic security assessment architecture for privacy-preserving context, explicit governance state, Control-in-Depth enforcement, governed materialization, and supervised self-growth.

Free Open Source Intelligence Resource Dump. Aka big list of OSINT.

Quick script to create strings with RTLO characters, change single filenames or even entire directories. Meant to be used for RTLO bypasses/testing in regards to hacking, offensive cyber security and penetration testing.

No description.

No description.

Public Release of a tiny group independent security research project into AOL Desktop Gold.

Standalone ONVIF device enumeration tool for authorized research: service discovery, capabilities, media/PTZ/imaging/events/security checks, interactive mode, JSON output, and service URL patching for IP cameras, NVRs, and OEM physical-security devices.

Public research release for Digital Ally ThermoVu DTM-600 / Uniview OET-213H-NB analysis: findings, notes, evidence, LAPI/ONVIF tooling, test artifacts, and standalone Uniview LAPI toolkit. Excludes raw firmware, private workflow files, and personal source images.

Standalone Uniview/OEM LAPI research client for authorized testing: endpoint profiles, safe read-only defaults, explicit write controls, fingerprinting, low-risk audits, and DTM-600 validation data.

Public research release for Mayton/AutoPro CarPlay dongle analysis: documentation, findings, test plans, logs, configs, disclosure notes, and source-based tools for cpctl/cpcp, CarPlay shim/sink work, and offline package handling. Excludes raw firmware images and extracted filesystems.

Basic N8N workflow that utilizes a file trigger for *.mp3 files uploaded to openweb-ui. It then sends the files to the whisper server and writes the transcription to a directory accessible by openweb-ui.

LeakLooker-X Working 2022