Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
recheck is a monorepo for a ReDoS (Regular expression Denial of Service) vulnerability checker, written in Scala 3 and cross-compiled to JVM and JavaScript via Scala.js. The system parses regular expression patterns, builds an execution model, and detects catastrophic backtracking vulnerabilities. It exposes multiple interfaces: a core library (`recheck-core`) with a high-level `ReDoS.check` API, a CLI (`recheck-cli`) with `check` and `batch` subcommands (the latter using JSON-RPC over stdio), JavaScript bindings (`recheck-js`) for browser/Node usage, and an ESLint plugin (`eslint-plugin-redos`) for CI integration. The architecture is a multi-module sbt build with Lerna/pnpm for JS workspace management, featuring clean separation between parsing, execution, unicode data, and platform-specific adapters.
This repository contains a proof-of-concept exploit for CVE-2026-41089, a critical stack buffer overflow in the Windows Netlogon service via CLDAP (UDP 389). The poc.py script sends a malformed LDAP search request with an oversized username to trigger the vulnerability, causing LSASS to crash and the domain controller to reboot. The implementation includes correct BER/DER encoding primitives for LDAP packet construction, which can be reused in other projects requiring LDAP protocol handling.
The gvm-tools repository provides a Python library and command-line utilities for interacting with Greenbone Vulnerability Management (GVM) systems via the Greenbone Management Protocol (GMP). It consists of a core library (gvmtools) that handles GMP communication, authentication, and data formatting, along with three main CLI tools: gvm-cli for raw command execution, gvm-script for running Python scripts in a GMP context, and gvm-pyshell for an interactive shell. The repository includes approximately 80 example scripts in the scripts/ directory demonstrating common GVM operations such as target management, task control, report generation, and asset discovery. The architecture is library-first, with the CLI tools and scripts built on top of the gvmtools package, which abstracts the underlying GMP/XML complexity. External dependencies include the python-gvm library for protocol handling, with additional dependencies for specific scripts (e.g., terminaltables for output formatting, cpe for CPE processing).
This repository contains a collection of example SQLMap command lines for bypassing Web Application Firewalls (WAF) during SQL injection penetration testing. It is essentially a cheat sheet or reference guide, not a software application. The content is provided in plain text files with various tamper script combinations and techniques. The repository has no actual code, scripts, or executable components; it solely consists of documentation and example usage. While the commands may be useful for security professionals, the repository itself is not a functional tool and has seen no active development since its creation around 2021.