Kali Linux Docker

Automatic Server-Side Template Injection Detection and Exploitation Tool

A collection of awesome penetration testing resources, tools and other shiny things

neo4j developer resources

ThreadFix is a software vulnerability aggregation and management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking s…

USBdriveby exploits the trust of USB devices by emulating an HID keyboard and mouse, installing a firewall-evading backdoor, and rerouting DNS within seconds of plugging it in

-OFFICIAL REPO - DISA STIG Compliance Automation leveraging Puppet, Ansible, and Bash

Deliberately insecure JavaEE application

Framework for Man-In-The-Middle attacks

An intentionally insecure RIA suitable for pen testing and security awareness trainings written in Node, Express and Angular.

STIG modules for Puppet (originally forked from Fedora Aqueduct)

Demonstrates the features of the Spring MVC web framework

PHP Secure Configuration Checker

Burp Plugin - Crawljax Selenium JUnit integration

Dependency-Check is a utility that detects publicly disclosed vulnerabilities in project dependencies.

REST/JSON interface to Burp Suite

Web Application Security Scanner Framework

Scripts I use during pentest engagements.

Source for the w3af web application attack and audit framework, the open source web vulnerability scanner.

Scratching my own itches on BackTrack 5

High Performance HTTP Proxy

SecLists is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more.

Operational toolset utilizing git's submodule feature

My talk from Javazone 2012

This is a Burp Suite plug-in designed to encode and decode WCF Binary Soap request and response data ("Content-Type: application/soap+msbin1). There are two versions of the plug-in available (consu…