Repositories list

• tsunami-security-scanner-plugins

  Public
  This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.

  Java

  •

  Apache License 2.0

  •214214 forks•00 stars•00 issues•44 pull requests•Updated May 2, 2026May 2, 2026

• security-testbeds

  Public
  Tcl

  •

  Apache License 2.0

  •4747 forks•00 stars•00 issues•33 pull requests•Updated May 2, 2026May 2, 2026

• osv-scalibr

  Public
  Go

  •

  Apache License 2.0

  •134134 forks•00 stars•00 issues•22 pull requests•Updated May 1, 2026May 1, 2026

• elbaph

  Public
  AWS Elastic Load Balancer Configuration Auditor

  Go

  •

  Apache License 2.0

  •00 forks•00 stars•00 issues•00 pull requests•Updated Apr 28, 2026Apr 28, 2026

• maSSO

  Public
  The malicious IdP you were looking for. A weaponized Single Sign-On (SSO) Identity Provider (IdP) for security testing of OIDC and SAML 2.0 Service Providers, a…

  Go

  •

  Apache License 2.0

  •00 forks•22 stars•00 issues•00 pull requests•Updated Apr 28, 2026Apr 28, 2026

• cloudsec-tidbits

  Public
  Blogpost series showcasing interesting cloud - web app security bugs

  awsterraformcloudsecurity

  awsterraformcloudsecurity

  HCL

  •44 forks•5353 stars•00 issues•00 pull requests•Updated Apr 28, 2026Apr 28, 2026

• inql

  Public
  InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Bu…

  graphqlsecurity-auditpenetration-testing+ 8

  graphqlsecurity-auditpenetration-testingbugbountysecurity-scannerburpsuitesecurity-toolsburp-extensionsgraphql-securityapi-documentation-tool+ 1

  Kotlin

  •

  Apache License 2.0

  •183183 forks•1.8k1.8k stars•2727 issues•99 pull requests•Updated Apr 22, 2026Apr 22, 2026

• tsunami-security-scanner

  Public
  Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

  Java

  •

  Apache License 2.0

  •923923 forks•00 stars•00 issues•00 pull requests•Updated Apr 16, 2026Apr 16, 2026

• burp-session-switcher

  Public
  A Burp extension that easily allows for switching a request's session (headers, cookies) on the fly

  Kotlin

  •

  Apache License 2.0

  •00 forks•22 stars•00 issues•00 pull requests•Updated Mar 11, 2026Mar 11, 2026

• ElectronSafeUpdater

  Public
  A secure Electron updater developed as a reference implementation for hardened software update mechanisms

  javascriptelectron-builderelectronjs+ 1

  javascriptelectron-builderelectronjssoftware-updater

  JavaScript

  •00 forks•55 stars•00 issues•00 pull requests•Updated Feb 13, 2026Feb 13, 2026

• KSMBD-CVE-2025-37947

  Public
  Blog Post: https://blog.doyensec.com/2025/10/08/ksmbd-3.html

  linuxexploitksmbd

  linuxexploitksmbd

  C

  •66 forks•2020 stars•00 issues•00 pull requests•Updated Oct 8, 2025Oct 8, 2025

• electronegativity

  Public
  Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.

  electronnodejssecurity+ 1

  electronnodejssecurityelectron-app

  JavaScript

  •

  Apache License 2.0

  •7171 forks•1k1k stars•1313 issues•11 pull request•Updated Aug 23, 2025Aug 23, 2025

• csharp_rand_py

  Public
  Optimized C# `Random` for security testing

  Python

  •00 forks•33 stars•11 issue•00 pull requests•Updated Aug 7, 2025Aug 7, 2025

• vibecoding-djinn

  Public
  Python

  •

  MIT License

  •00 forks•44 stars•00 issues•00 pull requests•Updated Aug 5, 2025Aug 5, 2025

• outline

  Public
  The fastest knowledge base for growing teams. Beautiful, realtime collaborative, feature packed, and markdown compatible.

  TypeScript

  •

  Other

  •3.3k3.3k forks•11 star•00 issues•00 pull requests•Updated Jul 14, 2025Jul 14, 2025

• burp-rest-api

  Public
  REST/JSON API to the Burp Suite security tool.

  Java

  •

  BSD 2-Clause "Simplified" License

  •115115 forks•1111 stars•00 issues•00 pull requests•Updated Jul 14, 2025Jul 14, 2025

• safeurl

  Public
  A Server Side Request Forgery (SSRF) protection library. Made with 🖤 by Doyensec LLC.

  appsecssrfgosec

  appsecssrfgosec

  Go

  •

  Apache License 2.0

  •1111 forks•110110 stars•11 issue•00 pull requests•Updated Jun 4, 2025Jun 4, 2025

• awesome-electronjs-hacking

  Public
  A curated list of awesome resources about Electron.js (in)security

  6464 forks•672672 stars•00 issues•00 pull requests•Updated May 14, 2025May 14, 2025

• CSPTPlayground

  Public
  CSPTPlayground is an open-source playground to find and exploit Client-Side Path Traversal (CSPT).

  csrfwebsecuritywebsec+ 2

  csrfwebsecuritywebsecappsec-testingcspt

  JavaScript

  •

  Apache License 2.0

  •1616 forks•160160 stars•11 issue•11 pull request•Updated Mar 31, 2025Mar 31, 2025

• malicious-devfile-registry

  Public
  Exploit for CVE-2024-0402 in Gitlab

  Dockerfile

  •55 forks•1515 stars•00 issues•00 pull requests•Updated Mar 18, 2025Mar 18, 2025

• GQLSpection

  Public
  GQLSpection - parses GraphQL introspection schema and generates possible queries

  Python

  •

  Apache License 2.0

  •1414 forks•101101 stars•77 issues•33 pull requests•Updated Mar 6, 2025Mar 6, 2025

• SSHNuke_info

  Public
  SSH Nuke Info

  exploitsshdvulnerability+ 1

  exploitsshdvulnerabilityexploit-development

  C

  •00 forks•1414 stars•00 issues•00 pull requests•Updated Mar 4, 2025Mar 4, 2025

• ComfyUI-tsunami-payload

  Public
  Python

  •00 forks•00 stars•00 issues•00 pull requests•Updated Mar 3, 2025Mar 3, 2025

• exploitable-IoT-solution

  Public
  !Exploitable IoT Exploit

  iotexploitappsec+ 2

  iotexploitappseciot-securitytenda

  C

  •00 forks•44 stars•00 issues•00 pull requests•Updated Feb 10, 2025Feb 10, 2025

• PESD-Exporter-Extension

  Public
  PESD (Proxy Enriched Sequence Diagrams) Exporter converts Burp Suite's proxy traffic into interactive diagrams

  Java

  •

  Apache License 2.0

  •88 forks•107107 stars•22 issues•00 pull requests•Updated Jan 30, 2025Jan 30, 2025

• Unsafe-Unpacking

  Public
  Unsafe Unpacking Vulnerability: Lab Code, Semgrep Rules and Secure Implementation Guide

  HTML

  •33 forks•4343 stars•00 issues•00 pull requests•Updated Dec 16, 2024Dec 16, 2024

• ruby-unsafe-deserialization

  Public
  Proof of Concepts for unsafe deserialization in Ruby

  Ruby

  •

  MIT License

  •33 forks•00 stars•00 issues•00 pull requests•Updated Oct 17, 2024Oct 17, 2024

• libajp13

  Public
  AJPv1.3 Java Library

  ajpapache-jserv-protocolajp13

  ajpapache-jserv-protocolajp13

  Java

  •

  Apache License 2.0

  •22 forks•44 stars•00 issues•00 pull requests•Updated Aug 22, 2024Aug 22, 2024

• wsrepl

  Public
  WebSocket REPL for pentesters

  Python

  •1515 forks•235235 stars•11 issue•11 pull request•Updated Jul 24, 2024Jul 24, 2024

• db-race-conditions-playground

  Public
  Database Race Condition Playground. Made with 🧡 by Doyensec LLC.

  mysqlpostgresdatabase+ 3

  mysqlpostgresdatabasemariadbtransactionsrace-conditions

  JavaScript

  •00 forks•88 stars•00 issues•00 pull requests•Updated Jul 11, 2024Jul 11, 2024