The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained documentation project defining standard test cases for web application security assessments. It is primarily a structured knowledge base written in Markdown, organized by testing categories including Information Gathering, Authentication, Injection, and API Testing. The repository also serves as the source for multiple derived artifacts: a Jekyll static website (wstg.owasp.org), downloadable PDF/EPUB ebooks via a Pandoc+Typst pipeline, and machine-readable test checklists in JSON, XLSX, and Markdown formats. The build infrastructure includes Python scripts for site generation and navigation, GitHub Actions for CI/CD (linting, link checking, deployment), and a versioned release process that supports multiple channels (latest, stable, past versions). Although the primary content is documentation, the repository functions as a publication platform with significant automation and is actively maintained by a community of contributors. It is not a software application in the traditional sense, but the build tooling and CI/CD pipelines qualify it as an application-focused project with strong data engineering characteristics in its checklist generation and structured content management.
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
OneForAll is a comprehensive subdomain enumeration and reconnaissance tool designed for security researchers and penetration testers. It aggregates subdomains from over 60 passive sources (certificate transparency logs, DNS datasets, search engines, threat intelligence feeds, and web crawlers), performs active brute-forcing via massdns, and enriches results with DNS resolution, HTTP probing, CDN detection, wildcard filtering, and subdomain takeover risk assessment. The tool is built as a modular Python CLI application, with each data source implemented as an independent plugin inheriting from base classes in `common/`. Output is stored in a SQLite database and can be exported to CSV, JSON, XLSX, and other formats. While primarily an application, the repository also includes curated data files (subdomain wordlists, CDN CIDR ranges, cloud service fingerprints) that are valuable for security research.
WebHackersWeapons is a curated, YAML-driven catalog of 400+ web security tools used in bug bounty hunting and penetration testing. The repository's primary artifact is a generated README.md and per-tag/per-language index pages, built from structured YAML files in the `weapons/` directory. Each weapon entry includes metadata such as name, description, URL, category, type, platform, language, and tags. The generation pipeline consists of a Ruby ERB script (`scripts/erb.rb`) that consumes the YAML data and produces Markdown tables, and a validation script (`scripts/validate_weapons.rb`) that checks for data completeness. CI/CD via GitHub Actions automatically regenerates documentation on pushes to main and lints YAML on pull requests. While not a traditional data pipeline or ML project, the repository functions as a structured dataset with transformation scripts, making it a hybrid of a curated list and a lightweight data engineering project. The data model is simple but extensible, and the generation pattern is reusable for similar awesome-list or registry projects.
This repository is a curated collection of wordlists for bug bounty hunting and web application security testing. It aggregates URL paths, payloads, and vulnerability probes from multiple public sources (SecLists, OneListForAll, dirsearch, nuclei-templates, etc.) into a unified, organized dataset. The wordlists are categorized by technology (e.g., Apache, WordPress, Nginx) and severity (info, low, medium, high, critical), making them directly usable with tools like Nuclei, ffuf, and dirsearch. The repository includes two automation scripts: a shell script that fetches and deduplicates wordlists from external URLs, and a Go program that parses nuclei-templates YAML files to generate technology-specific wordlists. These scripts are run weekly via GitHub Actions to keep the dataset current. The repository is purely a data asset; it contains no application code, APIs, or services. Its primary value is as a ready-to-use, aggregated wordlist source for security researchers and penetration testers.
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
The exifLooter is a command-line application written in Go that extracts EXIF metadata, particularly GPS coordinates, from image files. It relies on the external exiftool command-line utility to perform the actual metadata extraction and provides a user-friendly interface for analyzing single images, directories of images, or images downloaded from URLs via stdin. The tool also offers functionality to remove all metadata from images and to generate OpenStreetMap URLs from GPS coordinates found in images. The architecture is a standard CLI tool built using the Cobra library for command parsing and the fatih/color library for colored terminal output. The main entry point is in main.go, which delegates to the command defined in cmd/root.go. The core functionality involves invoking exiftool via os/exec, parsing its output to detect GPS-related tags, and presenting the results with color-coded warnings when geolocation data is detected. Additional features include downloading images from URLs (with validation of content type) for batch processing in a pipe mode. While the tool fulfills its intended purpose, the codebase exhibits some areas for improvement: the pipe mode's image validation step is inefficient (rescanning the entire directory for each download), the OpenStreetMap URL generation function incorrectly handles southern and western hemisphere coordinates, and there is a lack of automated tests. Despite these issues, the project is actively maintained with recent commits and uses dependency management via Go modules.
This repository is a curated directory of cybersecurity tools and resources, organized into categories such as AI security, API pentesting, C2 frameworks, forensics, OSINT, and more. It is built as a static documentation site using Retype, with markdown pages listing external links and brief descriptions. The repository contains no executable application code, data pipelines, or analytical models. Its primary function is to serve as a reference index for security professionals, maintained through periodic updates to links and categories. The codebase is essentially a collection of markdown files and configuration for the static site generator, with a large set of default password text files included as a resource. There is no software architecture, entry points, or data flows beyond the static site generation. The repo is well-organized and regularly updated, but it offers no reusable software components or novel engineering patterns.
This repository contains only documentation and configuration files (README, CONTRIBUTING, issue templates, .gitignore) with no actual source code present. The README describes SpiderSuite as a cross-platform web crawler for security professionals, but the codebase itself is empty in this snapshot. No functional analysis is possible. The repository appears to be a stub or the source code is hosted elsewhere. Given the absence of any executable or library code, this repository provides no reusable software assets.