A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

Passive hostname, domain and IP lookup tool for non-robots

Tool to parse subdomains from dmarc.live

🐙 Cross-document messaging security research tool powered by https://enso.security

Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan & VirusTotal!

Downlaod all the nuclei Templates created from many Bug Hunters

An extremely effective subdomain enumeration wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4 space.

Tool for Active Directory Certificate Services enumeration and abuse

A python script that finds endpoints in JavaScript files

Some useful test data or payloads

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

A Python based ingestor for BloodHound

A Python based ingestor for BloodHound

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Knock Subdomain Scan

CVE-2021-40444 PoC

A little tool to convert ccache tickets into kirbi (KRB-CRED) and vice versa based on impacket.

Active Directory certificate abuse.

CVE-2021-4034 1day

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab