thehardwarestore.ai

Knife is a feature-rich Burp Suite extension written in Java that enhances Burp's functionality through right-click context menus, automatic request modification, and additional message editor tabs. It provides tools for cookie management (update/set from history), header manipulation, host/scope additions, running external commands (SQLMap, Nmap) with request data as variables, chunked transfer encoding, URL discovery and fuzzing, Unicode-to-Chinese decoding, and information extraction (URLs, emails, IPs) from responses. The plugin uses a configurable rules engine stored as JSON to automatically add/replace/remove headers, drop or forward requests based on host/URL/keyword matches, and control scope via tool flag and URL pattern matching. Configuration is managed through a comprehensive GUI table. The codebase is well-organized with clear separation of concerns, though some deprecated classes remain. It relies on the Burp Extender API and several Apache and Google libraries.

Pentest-Swarm-AI is an open-source autonomous penetration testing tool built on a stigmergic swarm architecture. It coordinates multiple LLM-driven specialist agents (recon, classifier, exploit, report) via a shared blackboard with pheromone decay, enabling emergent attack paths without a central planner. The system integrates 30+ external security tools (nmap, nuclei, sqlmap, etc.), multiple LLM providers (Claude, OpenAI, Ollama, Gemini, LM Studio), and bug bounty platforms (HackerOne, Bugcrowd, Intigriti) for automated scope import and report submission. The architecture is a multi-agent system with a scheduler that dispatches agents based on blackboard predicates and pheromone levels. Key entry points include a CLI (Cobra commands: scan, init, playbook, submit, etc.), an API server (Fiber), a WebSocket hub for live streaming, a Next.js web dashboard, and an MCP server for IDE integration. Data flows: agents write findings to the blackboard with pheromone weights; the scheduler reads the blackboard and triggers agents whose predicates match; agents read findings, process them, and write new findings, creating a stigmergic feedback loop. External dependencies include PostgreSQL with pgvector for durable blackboard storage, LLM API endpoints, and the installed security tool binaries. The codebase demonstrates high craftsmanship with clean abstractions (tool adapter pattern, LLM provider interface, blackboard interface), extensive testing (unit, integration, e2e, benchmarks, LLM eval), and safety features (scope enforcement, provenance signing, rate limiting, false-positive caching). It is actively maintained with recent commits, CI/CD pipelines, and community engagement.

This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.

AntSword is an Electron-based desktop application for managing web shells on remote servers, primarily used by penetration testers and authorized security researchers. It provides a tabbed interface for shell management, file browsing, virtual terminal access, database querying, and plugin execution. The core engine in source/core generates HTTP requests from per-language templates (PHP, ASP, ASPX, JSP, etc.), applies configurable encoders/decoders for obfuscation, and parses responses using charset detection. Shell credentials and settings are persisted locally via nedb through modules/cache.js and modules/database.js.

Mentalist is a desktop GUI application for generating custom wordlists targeting password security auditing. Built with Python Tkinter, it allows users to construct chains of operations (base words, case changes, substitutions, appending/prepending) to produce wordlists or rule sets compatible with Hashcat and John the Ripper. The application follows an MVC architecture: the model handles chain/node/attribute logic, the view manages Tkinter UI components, and the controller mediates between them. Key features include real-time word count estimation, saving/loading chain configurations, and background threading for responsive UI during intensive operations. The tool is designed for authorized penetration testing and includes bundled word lists and reference data.

LLMMap is a CLI-based automated prompt injection testing framework for LLM-integrated applications, modeled after sqlmap. It systematically discovers injection points (query parameters, headers, body, cookies, path), generates goal-aware adversarial prompts using a dual-LLM architecture (Generator + Judge), and evaluates responses through pattern matching, semantic similarity, and out-of-band callbacks. The tool supports 227 injection techniques across 18 attack families, multiple LLM providers (Ollama, OpenAI, Anthropic, Google), and provides reliability confirmation via Wilson confidence intervals. It includes comprehensive reporting, data-flow tracing, and Burp Suite integration. The codebase is well-structured with clean abstractions, extensive tests, and reusable components, though some modules are reserved for future development and external dependencies like interactsh-client introduce fragility.

reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.

This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.

Seeker is a CLI-based social engineering tool that hosts fake web pages designed to trick users into granting geolocation permissions. When a victim visits the served page, JavaScript collects precise GPS coordinates, device fingerprinting data (OS, CPU cores, RAM, screen resolution, GPU, browser, IP addresses), and public IP information via ipwhois.app. The tool uses PHP's built-in server to serve the templates and handles incoming data through PHP endpoints that write to local log files. Seeker then polls these logs, stores results in CSV/KML formats, and can forward captured data to Telegram bots or Discord webhooks. It supports multiple phishing templates (Google Drive, WhatsApp, Telegram, Zoom, reCAPTCHA, and a 'NearYou' map page) and integrates with tunneling services like ngrok for public exposure. The repository is primarily a penetration testing and educational proof-of-concept, demonstrating the ease of harvesting geolocation data through deceptive web pages. While functional and well-documented, the codebase lacks tests and uses environment-variable-driven configuration to avoid interactive prompts in deployment scenarios.

Evil Limiter is a Linux command-line tool that uses ARP spoofing and traffic shaping (tc/iptables) to monitor, analyze, and limit the bandwidth of devices on a local network without requiring administrative access to those devices. It provides an interactive shell with commands to scan for hosts, limit or block bandwidth per host (upload/download), monitor real-time bandwidth usage, and detect host IP changes. The architecture is a single-threaded interactive menu with background threads for ARP spoofing, bandwidth monitoring, and reconnection watching. It depends on scapy for packet manipulation, netifaces for network interface info, and standard Linux utilities (tc, iptables, sysctl). The codebase is well-organized into modules for console UI, networking operations, and command parsing, but lacks tests and has limited reusability outside its specific purpose.

This repository is a comprehensive collection of red teaming tactics, techniques, and procedures (TTPs) presented as markdown cheatsheets and guides. It is not a software application or data pipeline; rather, it is a knowledge base containing hundreds of embedded code snippets (bash, PowerShell, Python, Go, Rust, C, etc.) organized by platform (Linux, Windows, macOS, Cloud, ICS, Web). The repo includes a few standalone tools such as an Azure subdomain enumeration Metasploit module, a Flask-based C2 redirector container, a PDF generation script, and a PAM module for credential harvesting. The primary value is as a reference for offensive security operators, not as a runnable application. Architecture is document-based with no API, CLI entry point, or library exports. External dependencies are minimal (mostly system tools).

DuplexSpyCS is a full-featured Remote Access Trojan (RAT) command-and-control (C2) framework written in C# (.NET WinForms). It consists of a server-side management console and multiple payload variants (winClient48, winClient48DLL, Tipoff, etc.) that provide comprehensive post-exploitation capabilities: file manager, remote desktop, keylogger, webcam/microphone streaming, registry editor, process/task manager, remote shell (including xterm via WebView2), SOCKS5 proxy, and a plugin system for credential theft (Chrome, Edge, Firefox, MobaXterm). Communication uses a custom binary protocol (clsDSP) over TCP, TLS, or HTTP with RSA-AES hybrid encryption. The payloads employ persistence via registry/startup, UAC bypass, process injection (APC, EarlyBird, CreateRemoteThread, etc.), and fileless execution. The codebase is extensive but exhibits significant code duplication across payload projects, many incomplete or stub features, and outdated dependencies (AForge, NAudio, SharpPcap). It is explicitly designed for offensive security research and learning, but carries high risk of misuse.

Pikachu is a deliberately vulnerable web application built as a training ground for web penetration testing, covering common security flaws such as SQL injection, XSS, CSRF, RCE, file inclusion, unsafe file upload/download, SSRF, XXE, and deserialization. It is a LAMP stack (PHP + MySQL + Apache) monolith using a legacy Ace Admin template and Bootstrap 3. The codebase is organized into vulnerability categories under `/vul/`, a main application for navigation and configuration, and a separate XSS management backend (`/pkxss/`) for collecting stolen cookies, phishing credentials, and keystrokes. The project intentionally uses insecure coding patterns (e.g., raw SQL concatenation, `eval()`, `unserialize()` on user input) to demonstrate exploitation, and includes some secure alternatives for comparison. The repository is explicitly marked as 'asleep' by its authors, who recommend a successor project. It is not suitable for production deployment but serves as a valuable educational resource for security students and CTF players.

This repository is the archived reference implementation of the CAI (Cybersecurity AI) framework by Alias Robotics. It is a comprehensive, open-source platform for building and deploying AI-powered offensive and defensive security automation. The codebase provides a full-stack agent framework including a Python SDK (Agent, Runner, tools, handoffs, guardrails, tracing, voice, MCP), a CLI/REPL with rich interactive features, a Textual-based TUI, a FastAPI REST API server, and a benchmarking suite (CAIBench) with cyber ranges and CTF challenges. The framework supports multiple LLM providers (OpenAI, LiteLLM, custom) and includes specialized agents for red teaming, blue teaming, bug bounty, DFIR, network analysis, and more. It also features continuous operations (24/7 autonomous loops), session management, cost tracking, and extensive refusal testing (400+ scenarios). While the repository is now archived and will not receive further updates, the SDK components (function_tool decorator, Handoff abstraction, tracing processors, voice pipeline) are well-crafted and could be extracted for reuse in other agent-based projects. The codebase is large and monolithic, with some global mutable state and test duplication, but overall demonstrates strong engineering practices in the cybersecurity AI domain.

SocialFish is a modern dynamic phishing toolkit designed for credential harvesting, session hijacking, and social engineering attacks. It provides a Flask-based web application with an admin dashboard for managing cloned login pages, capturing credentials, intercepting OTP/2FA codes, tracking victim sessions, and injecting post-capture attack payloads (e.g., keyloggers, clipboard stealers, tab jacking). The system supports browser automation via Playwright and Selenium to clone JavaScript-heavy and SPA login flows, and includes tunneling via ngrok/cloudflared for exposing phishing URLs remotely. The architecture is a monolithic Flask app with SQLite storage, WebSocket real-time updates, and a mobile API authenticated by QR tokens. External dependencies include Flask, Flask-SocketIO, Flask-Login, Playwright, Selenium, nmap, qrcode, and PyLaTeX. Despite its feature-rich surface, the codebase exhibits significant quality issues: broken async flows, missing database columns, incomplete routes, version mismatches between requirements files, and security concerns such as default credentials and insecure secret key generation. The project is actively maintained (last commit 2026-05-20) but the code is not production-ready as claimed in documentation.

This repository is an archived collection of interview preparation notes for penetration testing and cybersecurity positions. It contains three markdown files: HR interview tips, a comprehensive technical question bank covering topics like SQL injection, XSS, network security, cryptography, and system administration, and a log of actual interview questions from specific companies. The content is well-organized and detailed, providing both strategic advice and technical depth. The repository is not a software application but a knowledge resource. It is explicitly archived by the author, who has moved on from the security field, but remains a valuable reference for aspiring security professionals.

This repository is a comprehensive collection of vulnerability proof-of-concept (PoC) exploits and detailed write-ups, primarily targeting Chinese enterprise software (OA, ERP, CMS, network devices, etc.). It contains over 1000 vulnerability entries organized by year and CVE identifier, each with structured risk assessments, HTTP request/response PoCs, FOFA search queries for asset discovery, and custom Snort/Suricata detection rules. The repository also includes executable Python scripts and YAML nuclei templates for automated exploitation and detection. While the majority of content is documentation, the scripts provide reusable scanning patterns with threading, proxy support, and output saving. The code quality is functional but basic, with many single-file scripts. The repository is actively maintained and serves as a practical reference for penetration testers and security researchers, though some CVE numbers appear speculative and PoCs may rely on future-dated vulnerabilities.

AssetsHunter is a Python-based information gathering framework designed for asset discovery and reconnaissance. It provides both active and passive modules for tasks such as web service detection (Hawkeye), information leakage checks (InfoRisk), CMS fingerprinting (WhatCMS), and various passive data collection methods including DNS resolution, WHOIS queries, SSL certificate transparency logs, and IP reputation services. The framework uses a modular architecture with command-line argument parsing to select specific reconnaissance modules. While functional, the code exhibits several quality issues: inconsistent error handling, tight coupling between modules and configuration, repetitive code patterns (especially in the passive modules), and limited use of modern Python practices. The framework demonstrates basic reconnaissance capabilities but lacks sophistication in areas like rate limiting, robust error handling, and modular extensibility.