This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
Ghidra is a software reverse engineering (SRE) framework
A professional, high-fidelity de-anonymization and vulnerability diagnostic framework. Features a zero-coupling modular architecture for browser-based intelligence gathering, hardware fingerprinting, and security research.
Check Risk WAF is an all-in-one Web Application Firewall with Anti-Bot and Anti-DDoS protection at L3, L4, and L7. Available on-premises or as SaaS, it protects web apps against OWASP Top 10 attacks, CWE vulnerabilities, botnets, and DoS/DDoS.
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
I have a blog where I write about Data Science and share open-source tools. You can find all my articles here.
6 fixes COM file-path parsing when a folder name contains an > executable extension, and limits historical coverage statements to evidence > actually examined. Optional Candiru patterns still need the pinned YARA-X engine; > see pattern validation.
DirtyFrag is a hardened fork of diabl0w/DFRoot. It exploits CVE-2026-43284 (DirtyFrag), a kernel page cache write primitive, to load a kernel module without an unlocked bootloader and without a custom kernel.
When an AI agent (Claude Code, Codex, Cursor, OpenCode, or another compatible client) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable…
SkillSpector helps you answer: "Is this skill safe to install?"
Red-teaming and evaluation framework for AI agents, built around an OWASP-inspired ASI01–ASI10 taxonomy
on the IP Track menu, you can combo with the seeker tool to get the target IP :zap: Install Seeker : - Get Seeker
A collection of various awesome lists for hackers, pentesters and security researchers
sh 会先构建并嵌入前端，再使用 Go linker 去除调试信息，并将发布文件压缩为 zip。Release 模式默认生成 Linux amd64/arm64、macOS amd64/arm64 和 Windows amd64 的 zip 包：
Hunt down social media accounts by username across social networks
> Featured: REA — Agent-oriented reverse-engineering tools, from application behavior to native binaries. By the creators of awesome-reverse-engineering.
> ### ⚠️ 严正法律免责与合规使用声明（Strict Legal & Compliance Disclaimer） > > 【零容忍严正申明】：本项目坚决反对并严禁任何形式的违法犯罪行为！本项目开发者绝不支持、不鼓励、不协助任何未授权网络攻击、漏洞利用、数据窃取、非法侵入计算机信息系统或生成违法违禁内容的活动。 > > 1.
Airgorah is a WiFi security auditing software that can capture nearby WiFi traffic, discover clients connected to access points, perform deauthentication attacks, capture handshakes and PMKIDs, and crack the password of access points.
LIST OF ALL MY JAILBREAKS
> OpenAI 호환 경로의 토큰 상한 함정. gpt-4o 처럼 OpenAI 계열 모델은 응답 토큰 상한이 16,384 입니다. 그런데 OpenAI 호환 요청에는 기본적으로 더 큰 출력 상한(32,768)이 실려, 그대로 두면 모든 호출이 400 (maxtokens is too large) 으로 실패합니다.
818 production-grade cybersecurity skills · 34 security domains · 6 framework mappings · 26+ AI platforms
json 的 generatedAt 时间戳，属正常。发布流程仍会实时刷新，发布产物里的目录是最新的。
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
> At least one of the supported USB adapters is required.
The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage.
Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Rows explicitly marked Shizuku required run through a shell UserService. Start Shizuku with ADB and tap the status card to grant access; all other rows use the app's normal execution path.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.