Nuclei is a template-based vulnerability scanner written in Go. It allows users to define security checks using YAML or JSON templates, which can be executed against a wide range of targets via multiple protocols (HTTP, DNS, network, file, etc.). The scanner features a modular architecture with a core engine that orchestrates template execution, a template system for parsing and compiling checks, and protocol-specific implementations for sending requests and processing responses. Key features include workflow chaining for multi-step attacks, fuzzing capabilities for dynamic application security testing, JavaScript extensibility for custom logic in templates, and integrations with various issue trackers and cloud platforms for result reporting. The project emphasizes performance through optimizations like template clustering (deduplicating identical requests across templates) and connection pooling. The codebase demonstrates strong engineering practices in several areas: a self-contained template clustering system for request deduplication, a JavaScript binding generation system that automates the creation of Goja-compatible libraries, a workflow context propagation system for sharing data between template steps, and a cryptographic template signing mechanism to ensure integrity. These components are designed to be reusable and showcase non-obvious solutions to common problems in security tooling. Maintenance is active with recent commits and a vibrant community. The project keeps pace with its ecosystem, showing low technical drift through regular updates to dependencies and active maintenance of generated code. Its extensive test suite and CI/CD pipelines further indicate a healthy, well-maintained project.
cdncheck is a Go library and CLI tool for identifying whether an IP address or domain belongs to a CDN, WAF, or cloud provider. It uses embedded CIDR range data (compiled from ASN, URL, and static CIDR sources) and efficient IP matching via the `bart` radix tree. The library provides a clean `Client` interface with methods like `CheckCDN`, `CheckCloud`, `CheckWAF`, and `CheckDomainWithFallback` that also resolve DNS and check CNAME suffixes. The CLI wraps this with input/output handling, filtering, and JSON output. The codebase is well-structured, with clear separation between core logic, data generation, and CLI runner. It is actively maintained by ProjectDiscovery and used in their security scanning ecosystem.
Swift Confidential is a sophisticated code obfuscation tool designed to protect string literals in Swift applications from static analysis and reverse engineering. The system employs a modular architecture consisting of Core obfuscation algorithms, a public API with Swift macros, utility functions, a YAML-based configuration parser, and a command-line tool. It provides two primary usage methods: compile-time macros (#Obfuscate) that transform plain string literals into obfuscated versions with runtime decryption capabilities, and a YAML-driven approach where a CLI tool processes configuration files to generate obfuscated Swift code. The core innovation lies in how each obfuscation technique (compression, encryption, randomization) not only obscures the data but also hides metadata about the method used—such as obfuscating compression magic bytes, encrypting key placement based on nonce bits, and obscuring shuffle patterns. This dual-layer approach significantly increases resistance to reverse engineering attempts. The project demonstrates strong maintenance with recent activity, up-to-date dependencies, and comprehensive testing.
SAP Privileges is a native macOS enterprise utility that grants standard users temporary administrator rights on demand, with automatic expiration and policy-driven revocation. The application is implemented in Objective-C and is composed of multiple cooperating processes: a main GUI app, a menu bar agent, a privileged launch daemon, an XPC service, a helper tool for system extension management, an Endpoint Security system extension for self-protection, a CLI tool, and a Dock tile plugin. The actual privilege change is performed by the daemon using Collaboration Services to add or remove the current console user from the admin group, while the system extension protects the app's files and launchd jobs from tampering. Configuration is driven by NSUserDefaults and can be forced via MDM configuration profiles, supporting expiration intervals, authentication requirements (biometric, password, smartcard), renewal, revocation on login/lock/time change, and remote logging via RFC 5424 syslog or JSON webhooks.
AlterX is a Go CLI tool and library for generating subdomain wordlists using a DSL (Domain-Specific Language) for patterns and an optional pattern mining mode. It ingests a list of known subdomains, extracts variables (sub, suffix, root, etc.), and applies user-defined or automatically discovered patterns to produce permutations. The architecture is modular: a Mutator engine orchestrates either default pattern-based generation (using ClusterBomb cartesian product) or pattern mining (via edit-distance clustering, n-gram analysis, and DFA-based regex generation). Key entry points are the CLI (`cmd/alterx/main.go`) and the library API (`mutator.go`). External dependencies include `fasttemplate` for variable replacement, `publicsuffix` for domain parsing, and `projectdiscovery/utils` for deduplication and other utilities. The pattern mining subsystem (ported from Regulator) uses a three-phase clustering algorithm and Brzozowski's DFA minimization to generate subdomains from observed patterns. The tool supports three modes: default (user patterns), discover (mined patterns only), and both (combined).
vexctl is a command-line tool for creating, applying, and attesting VEX (Vulnerability Exploitability eXchange) data. It is built as a single binary using Cobra for CLI, with subcommands for creating VEX documents, merging them, filtering SARIF scanner results, generating attestations, and validating documents against the OpenVEX specification. The tool integrates with Sigstore for keyless signing and supports multiple VEX formats (OpenVEX native, CSAF, CycloneDX). It can attach VEX attestations to container images via OCI referrers API or legacy tag layout. The architecture follows a clean separation of concerns: CLI handlers in `internal/cmd/` delegate to a core library in `pkg/ctl/`, which uses an interface (`Implementation`) for testability. The `pkg/attestation/` package handles in-toto attestations and Sigstore signing independently. The codebase demonstrates strong engineering practices with dependency injection, options struct patterns, and comprehensive test data. While primarily an application, it also processes vulnerability data (SARIF, VEX documents) and includes validation logic that could be reused in other security tooling.
WinObjEx64 is a native Windows GUI application that provides deep introspection into the Windows Object Manager namespace and kernel internals. It allows users to browse, view properties, and edit security descriptors for a wide range of NT object types (processes, threads, tokens, sections, ALPC ports, drivers, etc.). The tool also includes 'Extras' dialogs for inspecting system call tables (SSDT), kernel callbacks, unloaded drivers, private namespaces, and more. It relies on a kernel driver (or alternative providers) for reading kernel memory and supports a plugin system for extensibility. Architecturally, the application is a monolith with a plugin subsystem. It uses a custom tree-list control, a lightweight runtime library (minirtl), and a driver provider abstraction layer that supports multiple backends (Microsoft's kldbgdrv, WinIO, custom driver). The codebase is heavily version-aware, with many structures and patterns hardcoded per Windows build (from 7 to 11 25H2). The plugin ABI is well-defined and versioned, allowing third-party plugins to integrate seamlessly. The repository is actively maintained, with recent commits and zero open issues. However, it exhibits medium technical drift due to reliance on undocumented kernel structures, hardcoded byte patterns, and some deprecated Win32 APIs. The code is of high craftsmanship for its niche, with several reusable components that could be extracted for other Windows internals projects.
Legba is a production-grade multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust. It operates as a CLI tool with a plugin-based architecture supporting 30+ protocols (HTTP, SSH, SMB, LDAP, Kerberos, SQL variants, NoSQL, message queues, SNMP, etc.). The core system uses an async runtime (Tokio) and a global plugin inventory managed via a `register_plugin!` macro and the `Plugin` trait. Credential sources are generated by a flexible expression parser that supports wordlists, globs, permutations, ranges, and combinations. Sessions can be saved and restored in JSON format, and output supports text, CSV, and JSONL. In addition to CLI, Legba exposes a REST API and an MCP (Model Context Protocol) server, enabling AI agents to drive credential testing programmatically. A YAML recipe system allows reusable attack configurations with variable substitution.
git-credential-keepassxc is a Rust-based Git credential helper that enables Git and shell scripts to store and retrieve credentials from KeePassXC. It implements the KeePassXC browser protocol to communicate with the password manager via socket/named pipe interfaces. The application provides subcommands for getting credentials (get), generating TOTP codes (totp), storing credentials (store), managing configuration (configure), verifying caller identity (caller), and other auxiliary functions. It features optional security enhancements including strict caller verification, YubiKey-based encryption of configuration files, and desktop notifications. The architecture follows a modular Rust CLI pattern with clear separation between argument parsing, configuration management, core protocol implementation, and utility functions.
masscan is a high-performance network port scanner capable of scanning the entire IPv4 Internet in under 5 minutes. Unlike typical scanners, it implements a custom TCP/IP stack to avoid kernel overhead, uses randomized probe ordering via a Feistel cipher (BlackRock) for stealth, and supports both IPv4 and IPv6. The scanner is architecturally a multithreaded C application with separate transmit and receive threads per network adapter, a lock-free ring buffer for inter-thread communication, and a plugin system for output formats (XML, JSON, binary, Redis) and protocol parsers (HTTP, SSH, SSL, SMB, etc.). Key entry points include main.c (initialization), main-conf.c (configuration), transmit_thread() (probe generation), and receive_thread() (response handling). External dependencies are minimal: libpcap (loaded dynamically) for raw packet I/O, and optional PF_RING for higher throughput. Lua scripting is also supported for custom extensions.
ruby-nmap is a Ruby library that provides programmatic access to the nmap network scanning tool. It consists of two main components: 1) A command-line interface builder (Nmap::Command) that allows Ruby programs to configure and execute nmap scans with full access to nmap's options through a Ruby DSL, and 2) An XML parser (Nmap::XML) that converts nmap's XML output into navigable Ruby objects representing hosts, ports, services, OS detection results, and script output. The library acts as a bridge between Ruby applications and the nmap executable, handling the complexity of command-line argument construction and XML parsing while providing an idiomatic Ruby interface. The project is actively maintained with recent commits, comprehensive test coverage, and support for multiple Ruby versions.
URLCheck is an Android application that operates as a URL interception and analysis tool. When a user opens or shares a URL, URLCheck intercepts it before the target app, displaying a dialog with detailed information and offering a modular processing pipeline. The system is composed of pluggable modules (e.g., pattern checker, URL cleaner using ClearURLs rules, VirusTotal scanner, unshortener, host labeler using StevenBlack lists, status code checker, intent flag editor, webhook, and more). These modules follow a consistent lifecycle (onPrepareUrl, onModifyUrl, onDisplayUrl, onFinishUrl) and can be enabled, disabled, or reordered. The app integrates with external services (VirusTotal API, unshorten.me, custom webhooks) and supports user-defined automation rules that trigger module actions based on URL patterns. It also features a backup/restore system, JSON configuration editors, a tutorial, and extensive localization (20+ languages). The architecture is clean and extensible, with several self-contained utility classes that could be extracted for use in other Android projects. Technical drift includes reliance on non-public Android APIs (e.g., ObjectAnimator, ValueAnimator) and reflection in the JSON editor, as well as external service dependencies that may change.
This is a Swift-based command-line tool and library (Injection framework) for manipulating Mach-O binaries. It can inject, remove, or alter load commands (LC_LOAD_DYLIB, LC_LOAD_WEAK_DYLIB, etc.) into executables, dylibs, and IPA archives. The tool also supports stripping code signatures, disabling ASLR, converting binaries for iOS simulator, and handling fat binaries. The code directly parses Mach-O headers and performs byte-level binary patching. It is built with the Swift Argument Parser and is available as both a CLI and a framework for integration into other macOS/iOS projects. The code demonstrates solid understanding of the Mach-O format and low-level binary manipulation, though there is some code duplication between the CLI and framework targets.
Facad1ng is a command-line URL masking tool designed for security research and phishing awareness training. It takes three inputs: an original URL, a custom domain, and phishing keywords, then generates masked URLs by shortening the original URL via services like TinyURL and embedding it in a deceptive format (e.g., https://[email protected]/path). The tool demonstrates how attackers obfuscate malicious links to aid defensive security training. The core functionality is implemented in Python with input validation, multiple shortener support, and a user-friendly interface featuring ASCII art and animated loading screens.
RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.