This repository is a comprehensive knowledge base for web security, covering vulnerability exploitation, penetration testing, and code audit techniques. It is organized into three main directories: 'exp/' for exploit techniques, 'vul/' for vulnerability principles, and 'penetration/' for penetration testing procedures. The content is detailed, well-structured, and includes practical payloads, detection methods, and defense strategies. It also features an AI/Wiki index for efficient retrieval. While not a software application, it serves as an invaluable reference for security professionals, CTF players, and red teamers. The only executable component is a Python script for log tampering.
GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
This repository is a collection of proof-of-concept (PoC) exploit codes demonstrating various heap exploitation techniques in the GNU C Library (glibc) across versions 2.23 to 2.43. Each PoC is a standalone C program designed to be compiled and executed to showcase a specific heap corruption technique (e.g., fastbin dup, tcache poisoning, house of spirit, etc.) under controlled conditions. The primary purpose is educational, targeting security researchers, CTF participants, and students studying binary exploitation. The architecture is organized around a build system (Makefile) that compiles version-specific exploits located in directories named after glibc versions. Each exploit is self-contained with a main function, simulating heap manipulations to achieve arbitrary memory writes or code execution. Key entry points include the Makefile for building, an interactive heap exploration tool (malloc_playground.c), and a CI workflow for automated testing across multiple environments. The repository relies on glibc, build tools, and Docker for environment setup, with a submodule providing access to multiple glibc releases. The repository exhibits strong engineering practices through its reusable components: the Makefile employs wildcard and foreach functions to manage version-specific builds without duplication; malloc_playground.c offers an interactive interface for heap analysis that can be reused in other educational contexts; and the CI workflow uses a matrix strategy to test exploits across glibc and Ubuntu versions. Actively maintained with recent commits and low technical drift, the project adapts to glibc's evolving security mitigations by updating techniques for new versions, ensuring continued relevance in heap exploitation education.
CodExt is a Python library and command-line tool that extends the standard library's codecs with over 120 custom encodings for data transformation. It provides encoding/decoding functionalities across domains including base encodings (baseN, base45, base85, etc.), cryptography (Vigenère, RSA, XOR), compression (gzip, LZ77/LZ78), steganography, and language-based transformations (Leetspeak, Morse, Braille). The system features a heuristic-based guess mode for automated multi-layered decoding and a macro system for chaining codecs. Architected as a plugin-based library, it allows dynamic registration of new codecs and is designed for CTF, security, and data obfuscation tasks. The codebase demonstrates strong modularity with clear separation of concerns between core functionality, codec implementations, and utility modules.
x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.
HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
Ret2Shell is a full-featured CTF (Capture The Flag) challenge platform built with a Rust backend (Axum web framework) and a SolidJS frontend. It manages the entire lifecycle of CTF competitions: game creation, challenge authoring (with Git-backed storage), team management, dynamic scoring (decay curves, milestones), and dynamic per-player challenge environments orchestrated on Kubernetes. The backend includes a custom Rune scripting engine for extensible challenge checkers, OAuth providers, and lifecycle hooks. It provides a REST API, a CLI client, event streaming (NATS), and a comprehensive admin web UI. Deployment is supported via Helm charts, docker-compose, or raw Kubernetes manifests. The platform handles authentication, captcha, email verification, media uploads, audit logging, and real-time communication via WebSocket/WSRX tunnels.
This repository is the CTF Wiki, a comprehensive, community-driven knowledge base for Capture The Flag (CTF) security competitions. It is a static documentation site built with MkDocs and the Material theme, supporting multiple languages (Simplified Chinese, Traditional Chinese, English). The content covers a wide range of security topics including binary exploitation (pwn), cryptography, reverse engineering, web security, blockchain, Android security, and miscellaneous challenges. The repository itself is not a software application but a collection of Markdown files, images, and configuration files that are built into a static website. It includes CI/CD pipelines for deployment to Netlify and GitHub Pages, a Dockerfile for production serving, and a build script (scripts/docs.py) for multi-language management. While the documentation is extensive and well-organized, the codebase is primarily configuration and build tooling, with limited reusable software components. The project shows signs of maintenance with recent commits, but many pages are incomplete or outdated, and some dependencies (Python 3.8, pydantic 1.5.1) are lagging behind current versions.
This repository is a community archive of Capture The Flag (CTF) challenges, solutions, and security talks from the SecTalks meetup group across multiple cities (Sydney, London, Berlin, etc.). It contains hundreds of challenge files (binaries, scripts, packet captures, images) and corresponding solution writeups and scripts. The repo is not a unified software application or data pipeline; it is a heterogeneous collection of security-related artifacts spanning many years. The primary value is as a reference for CTF participants and security enthusiasts. The code quality varies widely: some solution scripts are well-crafted cryptographic attack implementations (e.g., RSA common modulus, CTR nonce reuse) that could be reused in other CTF contexts, while many are one-off scripts tightly coupled to specific challenges. The repository lacks centralized dependency management, and many challenges require specific environments or tools. It is actively maintained with recent commits and talks.