Submit your favorite resources for free.
Find red teaming, penetration testing, and ethical hacking resources in seconds.
Online firmware analysis tool powered by binwalk v3. Analyze blobs, extract file systems (SquashFS/JFFS2), and chart entropy directly in the browser.
Hunt for AI coding artifacts containing secrets by scanning public GitHub repositories for leaked credentials in AI coding tool configuration files.
AWS security scanner with attack chain detection. 47 checks, Terraform remediation for every finding, scan diff. Free. pip install cloud-audit
crAPI is a completely ridiculous API vulnerable by design, built on a microservices architecture, designed to help understand API security risks.
crt.sh is a Certificate Transparency (CT) log search tool that allows users to find SSL/TLS certificates issued for specific domains or organizations.
Open-source tools and resources for vulnerability disclosure, promoting safe harbor and standardized practices for hackers and organizations.
dnstwist is a phishing domain scanner that finds lookalike domains adversaries can use to attack you, helping to identify potential threats.
Donut generates position-independent shellcode to load .NET Assemblies, PE files, VBScript, and other Windows payloads from memory.
The eCPPT certification validates practical penetration testing skills, covering reconnaissance, web app testing, exploit development, and Active Directory.
ffuf is a fast web fuzzer written in Go, designed for content discovery and web application security testing.
Garak is an LLM vulnerability scanner that probes for weaknesses like prompt injection, data leakage, hallucination, and toxicity.
Windows host scanner that identifies LOLBAS binaries based on your current privilege level with MITRE ATT&CK mappings and example commands.
