DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
wechatpay-axios-plugin is a Node.js SDK for interacting with WeChat Pay APIs (both v2 and v3). It provides a promise-based, chained interface for making API requests, handles automatic request signing and response verification, includes cryptographic utilities for AES/RSA operations, and offers CLI tools for developers. The architecture centers around a Wechatpay class that creates axios instances for XML-based (APIv2) and JSON-based (APIv3) endpoints, with specialized transformers for data format conversion and security handling. The library actively maintains compatibility with modern Node.js versions and cryptographic standards.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
TheAlgorithms/Rust is a large educational library of algorithm and data structure implementations in Rust, organized into over 20 modules covering sorting, searching, graph theory, dynamic programming, cryptography, machine learning, math, string processing, and more. The codebase is structured as a reusable Rust library crate with a flat module hierarchy, each module containing self-contained functions and types with extensive inline documentation and unit tests. It serves as a reference and learning resource rather than a production application, with many implementations based on textbook algorithms and well-known specifications (RFCs, NIST standards). The code demonstrates good engineering practices such as modular design, property-based testing with quickcheck, use of generics and traits for abstraction, and consistent test patterns. However, some modules show inconsistencies in naming and error-handling conventions, and the sheer variety of implementations means code quality varies. The repository is actively maintained with recent commits, automated CI/CD workflows, and dependency updates via Dependabot. While the implementations are pedagogical and not necessarily production-grade (e.g., simplified RSA, educational AES without side-channel resistance), they are functionally correct and well-documented, making this a valuable resource for learning algorithms in Rust.
This repository is a pure Python library implementing elliptic curve cryptography algorithms, specifically ECDSA (Elliptic Curve Digital Signature Algorithm), ECDH (Elliptic Curve Diffie-Hellman), and EdDSA (Edwards-curve Digital Signature Algorithm). It provides key generation, signing, verification, and shared secret derivation functionalities across multiple curve types including NIST prime curves, Brainpool curves, and twisted Edwards curves (Ed25519/Ed448). The library is structured as a modular package with clear separation of concerns: high-level API in `keys.py`, low-level arithmetic in `ellipticcurve.py`, curve definitions in `curves.py`, ASN.1 DER handling in `der.py`, and utility functions for encoding/decoding in `util.py`. While the code is well-structured and includes comprehensive test suites, the project explicitly states it is not designed for production security due to vulnerability to side-channel attacks, recommending wrappers like `pyca/cryptography` for sensitive applications.
Intel ISA-L Crypto is a production-grade, high-performance cryptographic library optimized for storage and networking workloads. It provides software implementations of AES (CBC, GCM, XTS), multi-buffer hashing (SHA1, SHA256, SHA512, MD5, SM3), multi-hash parallel hashing, rolling hash for content-defined chunking, and FIPS 140 self-tests. The library is not an application but a low-level C library with assembly (x86 SSE/AVX/AVX512/VAES/AVX10, ARM NEON/SVE/SVE2, RISC-V RVV) to maximize throughput on modern CPUs. The codebase is organized by algorithm (aes/ sha1_mb/ mh_sha1/ rolling_hash/) with architecture-specific subdirectories. It uses a robust multi-buffer job manager pattern (init/submit/flush) for all hashing algorithms and a multibinary dispatcher to select the optimal SIMD variant at runtime. Extensive test suites (standard vectors, random, streaming, performance, fuzz) validate correctness against OpenSSL and NIST vectors. The library is actively maintained, supports multiple build systems (autotools, cmake, nmake), and includes CI for Linux, Windows, ARM64, and RISC-V. While the code is professionally engineered with high performance as the primary goal, it suffers from significant duplication across hash algorithms and ISA variants, making maintenance and extraction of individual components non-trivial. It is not a general-purpose crypto library but specifically targets scenarios requiring maximum throughput on Intel and ARM processors, making it ideal for integration into storage appliances, network appliances, and DPDK-based packet processing.
TheAlgorithms/JavaScript is an extensive open-source collection of over 700 algorithm and data structure implementations in JavaScript, designed for educational purposes. It covers a wide range of categories including sorting, searching, dynamic programming, graph algorithms, cryptography, math, string manipulation, and more. Each algorithm is implemented as a standalone module with corresponding tests, following ES module syntax. While primarily a learning resource, several components like caching classes (LRU, LFU), memoization utilities, and classic data structures (binary heap, AVL tree, Trie) demonstrate high-quality, reusable patterns. The repository employs CI/CD, linting, and automatic directory updates, ensuring code consistency. However, some modules exhibit minor issues such as DOM dependencies in Node context and duplicate implementations, reflecting the community-contributed nature of the project.
This repository is not a software application, service, or data pipeline; it is a curated awesome-list of open-source multiparty computation (MPC) resources, stored almost entirely as a single Markdown document plus contribution and code-of-conduct files. The core artifact, readme.md, categorizes roughly 100 projects and educational materials into Theory (books, courses, tutorials), Software (apps, frameworks, primitives, protocols, tools, retired software), and Workshops. Each entry includes a concise description, links to relevant academic papers, and maintenance context. There is no executable code, no package manifest, no CI configuration, and no tests; the repository's real architecture is its taxonomy and the editorial rules in contributing.md.
This repository is a configuration-only bundle for the cryptostorm VPN service, providing OpenVPN client configuration files (.ovpn) organized by cryptographic method (RSA, ECC, Ed25519, Ed448, and post-quantum ML-DSA-87) and server location. Despite having no application source code, the repo is classified as an application because it delivers ready-to-use configuration templates for a network service. The configs are well-structured, with extensive inline comments explaining security choices, cipher performance, and usage instructions. Each .ovpn file follows a consistent template with embedded CA certificates and shared tls-crypt/tls-auth keys. The repository serves as a distribution point for end-users to connect to cryptostorm servers, with a focus on transparency and user education.
This repository is a comprehensive cybersecurity knowledge base focused on offensive security techniques, particularly binary exploitation, cryptography, reverse engineering, and CTF challenge writeups. It serves as an educational resource containing detailed tutorials, exploit development guides, and solution writeups for various platforms (HackTheBox, picoCTF, etc.). The content is organized by topic with markdown files explaining concepts ranging from basic stack overflows to advanced heap exploitation techniques like tcache poisoning and kernel attacks. While not containing runnable applications, it provides reusable exploit methodologies and code snippets that security practitioners can adapt for learning and CTF preparation.
goploader is a self-hosted file sharing system consisting of a Go-based command-line client and web server. The server provides both a web interface and REST API for file uploads/downloads, featuring optional client-side encryption (where encryption keys are never stored server-side), automatic expiration-based cleanup, and metadata storage via BoltDB. The client supports terminal-based uploads with features like progress bars, screenshot capture, and clipboard integration. Architecture follows a layered design with separation between HTTP handlers (views), data models, and utility components. While the core functionality is well-implemented, the codebase shows signs of technical debt including outdated frontend dependencies (Font Awesome 4.7.0), inconsistent Go version references, and a cryptographic concern (static IV in AES encryption mode). The maintainer explicitly notes the technology is outdated but maintains the repository in a working state.
This is a monorepo for the Ember.js-based encrypted chat application 'emberclear', which provides end-to-end encrypted messaging with no server-side message storage. The architecture is modular, consisting of multiple Ember addons (crypto, networking, local-account, UI, test-helpers, tracked-local-storage) and a separate card game app (pinochle) that reuses the same networking and crypto infrastructure. The chat app uses public-key cryptography (tweetnacl, libsodium) via web workers, relays messages through Phoenix WebSocket relays, and persists data locally via IndexedDB and localStorage. It includes features like QR code identity sharing, channel voting with cryptographic chains, and a state-machine-driven setup wizard. The codebase is well-tested with QUnit, acceptance tests, and smoke tests, but shows signs of technical drift with outdated dependencies (Node 14, Ember 3.26.1), many TODO comments, and incomplete features (e.g., voting, QR login transfer). The pinochle game app appears experimental but demonstrates sophisticated state machine usage and animation systems.
cloudflare/tls-tris is a Go library that extends the standard library's crypto/tls package with experimental TLS 1.3 support, post-quantum key exchange (SIDH, SIKE, and hybrids), delegated credentials, and 0-RTT. It is not a standalone package; it replaces the Go standard library's crypto/tls via a patched GOROOT. The library implements full client and server TLS 1.3 handshakes, record layer processing, session ticketing, and provides APIs consistent with the standard Go tls package (tls.Config, tls.Conn, tls.Dial). The codebase is derived from Go 1.10-era crypto/tls with extensive modifications. It includes integration with Cloudflare's SIDH library for post-quantum cryptography and supports hybrid key exchange combining X25519 with SIDH or SIKE. The repository contains comprehensive test infrastructure including golden test data files, BoringSSL test suite runner (bogo), Docker-based interop testing against other TLS implementations (NSS, picotls, mint), and Caddy integration examples. However, the TLS 1.3 implementation is based on early IETF drafts (draft-18, -21, -22, -28) and is not compliant with the final RFC 8446. The post-quantum algorithms SIDH and SIKE have been broken by the Castryck-Decru attack; this code is cryptographically obsolete. The library requires a custom Go toolchain (patched from Go 1.10) and cannot be vendored or used as a standard Go module, making it incompatible with modern Go development workflows.
This repository is a community archive of Capture The Flag (CTF) challenges, solutions, and security talks from the SecTalks meetup group across multiple cities (Sydney, London, Berlin, etc.). It contains hundreds of challenge files (binaries, scripts, packet captures, images) and corresponding solution writeups and scripts. The repo is not a unified software application or data pipeline; it is a heterogeneous collection of security-related artifacts spanning many years. The primary value is as a reference for CTF participants and security enthusiasts. The code quality varies widely: some solution scripts are well-crafted cryptographic attack implementations (e.g., RSA common modulus, CTR nonce reuse) that could be reused in other CTF contexts, while many are one-off scripts tightly coupled to specific challenges. The repository lacks centralized dependency management, and many challenges require specific environments or tools. It is actively maintained with recent commits and talks.
This repository is a collection of web scraping and anti-crawler reverse engineering practice scripts targeting over 40 Chinese websites. Each site has a dedicated folder containing a Python script (demo.py) that orchestrates scraping by executing a JavaScript file (demo.js) via execjs. The JavaScript files implement cryptographic algorithms (AES, RSA, MD5, SHA, etc.) extracted from the target websites to generate request signatures, encrypt passwords, or decrypt responses. The project is primarily a learning resource for reverse engineering techniques, not a production scraping framework. It includes documentation for each case, a changelog tracking API changes, and some utility scripts. The code is ad-hoc, tightly coupled to specific sites, and lacks tests or error handling, making it fragile and high-maintenance. While the individual scripts are functional, they are not reusable without significant adaptation due to hardcoded keys and site-specific logic.
This repository is not a software application or a data pipeline; it is a document archive of cybersecurity publications, mostly in Spanish, authored or co-authored by Dr. Alfonso Muñoz. The content includes books and reports on SSL/TLS protocol attacks and cryptanalysis, stegomalware and antivirus evasion via steganography, offensive prompt engineering, AI-applied threat intelligence, and RADIUS protocol vulnerabilities. There are no source files, no README, no build configuration, and no tests; the only non-PDF item is a single JPEG image and the .git directory itself.
This repository is a listing of 50 final-year project ideas covering machine learning, blockchain, web development, and cryptography. It contains only a README file that describes each project and provides links to YouTube tutorials. The actual source code, documents, and explanation videos are not included in the repository; instead, the README directs users to contact the author via email or WhatsApp to obtain the materials. The repository functions as a marketing page rather than a functional codebase. No code, data, or configuration files are present, making it impossible to evaluate architecture, reusability, or data lineage.