Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
Maigret is a username-based OSINT reconnaissance tool that checks across thousands of websites for accounts associated with a given username, extracts profile information via the socid_extractor library, and generates multi-format reports (HTML, PDF, CSV, JSON, Markdown, XMind, Neo4j, etc.). It operates as a CLI tool, an embeddable Python library, a Flask web application with live scan streaming, and a Docker image. The architecture is a monolith with a clean separation between site database management (MaigretDatabase/MaigretSite models), asynchronous checking engine (AsyncioQueueGeneratorExecutor, checkers for aiohttp, curl_cffi, Cloudflare bypass), extraction enrichment, and report generation. External dependencies include aiohttp, socid_extractor, curl_cffi, aiodns, and potentially FlareSolverr and OpenAI-compatible APIs (optional). The tool supports proxy/Tor/I2P routing, self-validation of site configurations, and auto-update of its site database. It is actively maintained, with frequent releases and a large community, and is used by professionals in OSINT, academic research, cryptocurrency investigations, and privacy analysis.
The LOLBAS project is a curated dataset of Windows binaries, scripts, and libraries that can be abused for malicious purposes (Living Off The Land Binaries and Scripts). Each entry is documented in YAML files with a standardized schema, including technical details, use cases, MITRE ATT&CK mappings, detection artifacts, and external references. The repository serves as a threat intelligence resource for offensive security research and defensive security operations, enabling threat hunting and detection rule development. Data is organized by file type (binaries, libraries, scripts) and maintained through community contributions with automated validation via Pydantic schemas.
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
Sherlock is a monolithic Python CLI for username enumeration across social networks. For a given username it fans out concurrent HTTP probes to roughly 400 external sites (defined declaratively in sherlock_project/resources/data.json), then classifies each response as Claimed / Available / Unknown / Illegal / WAF using three detection modes: HTTP status code, presence/absence of a site-specific error message in the response body, or redirect behavior (redirects disabled, 2xx/3xx means claimed). Requests run in parallel via a requests-futures session capped at 20 workers; an optional per-site regex short-circuits illegal usernames without sending a request, and hardcoded fingerprint strings detect Cloudflare / PerimeterX / AWS WAF blocks. The CLI accepts one or more usernames, supports {?} wildcard expansion into `_`, `-`, `.` variants, and reports results to the terminal via a QueryNotify observer, with optional .txt, .csv, and .xlsx export. The system is fully data-driven: no per-site code exists. Each manifest entry declares the probe URL, error detection method, error signatures, optional headers/request method/JSON payload, and NSFW flag; a JSON Schema (data.schema.json) enforces conditional consistency (e.g., errorMsg required when errorType includes 'message'). By default the manifest is fetched live from https://data.sherlockproject.xyz, with an ephemeral false-positive exclusion list pulled from a dedicated GitHub branch; --local, --json, and --site flags override this behavior. Entry points are the `sherlock` console script, `python -m sherlock_project`, a Docker image entrypoint, and an Apify Actor (.actor/) that wraps the Docker image and pushes JSON results into an Apify dataset. Engineering strengths include the declarative manifest/schema design, a genuinely useful test suite (schema validation, live-target probe tests, randomized false-positive fuzzing, a Unicode regression test for issue #2730), and CI that runs a tox matrix across Python 3.10-3.14t on three OSes, validates only manifest entries modified by a PR, comments the validation summary back on the PR, and updates the exclusions list daily. Weaknesses: nearly all orchestration and output-format logic lives in a ~1,200-line sherlock.py; notify.py uses a module-global result counter; sites.py has mutable default arguments and a dead username_unclaimed parameter; the --print-found flag is always True (store_true combined with default=True); stem is an unused declared dependency; and the request layer relies on requests-futures, an effectively unmaintained library. The project is actively maintained and extremely popular (93k+ stars), and its health depends on hundreds of external sites remaining stable, hence the extensive removed-sites documentation and dedicated false-positive/false-negative issue templates. Technical drift is moderate rather than severe: the Python ^3.9 floor is now EOL, requests-futures is unmaintained, the WAF fingerprint catalog has not been extended since late 2024, and the PyPI readme still documents removed --tor flags.
This repository is a curated, bilingual (English/Chinese) OPML feed collection focused on cybersecurity and AI, containing approximately 1000+ RSS/Atom feed URLs organized into 12 categories (e.g., Crypto, Pwn, WebSecurity, MobileSecurity, AI). It serves as the data backbone for a personal intelligence pipeline, designed to feed into AI-curated daily security digests. The repo includes automation scripts for feed health monitoring (opml_sync.py with HTTP retries, gzip/deflate decoding, and stateful failure tracking), interactive feed addition (add_feed_to_tiny.py), and optional LLM-assisted pruning (prune_opml.py). A GitHub Actions workflow runs sync operations on push and validates PRs. The actual value lies in the carefully vetted list of high-quality security sources, including many from the Chinese security community, with automated dead-link detection and deduplication. The scripts are well-structured and testable, but the repository's primary deliverable is the curated data, not the application logic.
This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.
The exifLooter is a command-line application written in Go that extracts EXIF metadata, particularly GPS coordinates, from image files. It relies on the external exiftool command-line utility to perform the actual metadata extraction and provides a user-friendly interface for analyzing single images, directories of images, or images downloaded from URLs via stdin. The tool also offers functionality to remove all metadata from images and to generate OpenStreetMap URLs from GPS coordinates found in images. The architecture is a standard CLI tool built using the Cobra library for command parsing and the fatih/color library for colored terminal output. The main entry point is in main.go, which delegates to the command defined in cmd/root.go. The core functionality involves invoking exiftool via os/exec, parsing its output to detect GPS-related tags, and presenting the results with color-coded warnings when geolocation data is detected. Additional features include downloading images from URLs (with validation of content type) for batch processing in a pipe mode. While the tool fulfills its intended purpose, the codebase exhibits some areas for improvement: the pipe mode's image validation step is inefficient (rescanning the entire directory for each download), the OpenStreetMap URL generation function incorrectly handles southern and western hemisphere coordinates, and there is a lack of automated tests. Despite these issues, the project is actively maintained with recent commits and uses dependency management via Go modules.
This repository is a community-driven collection of DuckyScript payloads designed for USB Rubber Ducky, Flipper Zero, and other HID attack devices. It primarily functions as a playbook for penetration testers and red teamers, offering ready-to-inject scripts that automate keystroke injection attacks. The codebase is organized into a flat file tree by platform (Windows, Linux, macOS, mobile) and category (credentials, remote_access, destructive, prank, exfiltration, recon, execution, etc.). Each payload is a self-contained DuckyScript file, often embedding PowerShell, Bash, or Python one-liners that are typed and executed on the target machine. The repository includes hundreds of payloads covering credential theft (e.g., browser password dumping, WiFi key extraction), remote access (reverse shells, persistence via systemd, scheduled tasks), destructive actions (fork bombs, zip bombs, file corruption), exfiltration (webhook, Dropbox, email), and pranks (RickRolls, fake updates, desktop trolling). The architecture is not a traditional application but a script library; the 'code' is primarily configuration/scripting rather than compiled software. Maintenance is active, with monthly snapshot tags and contributions, though many payloads suffer from hardcoded URLs and dependencies on specific OS versions, leading to moderate technical drift. The repository does not contain data pipelines, notebooks, or ML models.