Minimal DAST harness: run nuclei/nikto behind one interface with local-only safety, per-scanner completion evidence, and a merged report - moovingGun/dast-harness

Contribute to Black1hp/makeswift-rce-poc development by creating an account on GitHub.

Responsive FileManager <= 9.14.0 — Authenticated RCE via `save_img` Path Traversal + Arbitrary File Write - Yucaerin/Responsive-FileManager-9.14.0

Vulnerable-by-design e-commerce training shop (XSS / SQLi / CSRF) built with PHP + SQLite - for educational purposes only. - Abdelrhman-Sherif-Mohamed/HakShop

Educational, container-only demonstration of cross-site scripting (XSS / CWE-79): a deliberately vulnerable app and its secure twin, side by side. Runs locally over loopback via Docker Compose agai...

About This is a repo of my solution of one XSS challenge website (http://sudo.co.il/xss/) . This challenges may have different types of solutions. My solutions are not the only one. So, keep search...

UploadSentinel 是一个面向授权安全测试、Web 安全评估和文件上传接口复核的桌面工具. Contribute to HooXuefeng/File-Upload-Security-Testing-Workbench development by creating an account on GitHub.

kali-pentest基于《Kali Linux渗透测试的艺术》方法论蒸馏，提供一个可被agent调用的、面向远程Kali Linux渗透测试的完整执行框架。 - githuBlijingai/kali-pentest

Agentic life cycle for this Spring project POC. Contribute to shrutikulkarni5020/SpringAIJIRAColab development by creating an account on GitHub.

Zhipu BigModel web fetch provider for DeepSeek Harness (dsh) — delegated web_reader MCP behind a ctx.web WebFetchProvider; SSRF surface nil, session handshake, per-fetch auditing - FWW321/dsh-web-f...

Scraper ringan untuk doujin.desu.xxx (API terenkripsi) & nekopoi.care — tanpa dependensi, anti-SSRF, sanitasi URL - kyy0887/doujin-scraper

Using CVE-2026-43499 to root your Galaxy S24 Ultra(SM-S9280 ,(China / Hong Kong SAR / Taiwan)) - NanoTurtle1145/root-my-s9280

ZAP add-on that converts HTTP requests between content types (JSON, XML, SOAP, URL-encoded, multipart form-data, YAML, GraphQL and plain text). Port of h0tak88r's Burp extension. - ArkhaMah...

MCP server bridge for DeepSeek Harness: stdio / streamable-http / legacy-SSE transports, web settings UI (form + JSON), tools as mcp__<server>__<tool>. Burp Suite ready ...

PipePwned es un laboratorio que simula un entorno CI/CD vulnerable, donde se explota una cadena de vulnerabilidades que incluyen IDOR, SSTI, fuga de información y escalada de privilegios mediante P...

Contribute to ebrahimgh21/SSTI-CHECKER development by creating an account on GitHub.

CVE-2026-59310. Contribute to HORKimhab/CVE-2026-59310 development by creating an account on GitHub.

GAP for ZAP: find the parameters, links and words that may not be obvious. Port of xnl-h4ck3r's GAP Burp extension. - ArkhaMahn/gap

An offline, Dockerized web app for teaching reflected XSS → cookie theft → account takeover, with three difficulty levels (Low / Medium / High). - rgsecteam/xss-lab

基于dsh web实现的工作模式，目的是服务于redteam进行安全研究，覆盖渗透测试、红队评估、代码审计等范围领域，请勿用于非法行为。 - SeaOf0/dsh-redteam-model

Cross-platform domain reconnaissance wrapper: one command runs DNS, HTTP, WAF/CDN, TLS, port and nuclei scans, with a graceful fallback for every stage - Lockbearer/easm-recon