FingerprintJS is a client-side browser fingerprinting library written in TypeScript. It collects over 30 entropy signals (canvas, audio, fonts, WebGL, etc.) from the browser environment and hashes them into a stable visitor identifier. The library operates in two phases: a load phase where entropy sources are prepared asynchronously, and a get phase where values are collected and combined. It includes stabilization logic for browsers that apply anti-fingerprinting measures (e.g., Safari 17, Firefox 120+) and provides a confidence score for the identifier. The architecture is modular: each entropy source is a separate function with a consistent interface, the agent orchestrates collection, and the hashing uses a custom MurmurHash3 x64 128-bit implementation. The library has no runtime dependencies and is tree-shakable. It is used for fraud detection and visitor identification without cookies.
cdncheck is a Go library and CLI tool for identifying whether an IP address or domain belongs to a CDN, WAF, or cloud provider. It uses embedded CIDR range data (compiled from ASN, URL, and static CIDR sources) and efficient IP matching via the `bart` radix tree. The library provides a clean `Client` interface with methods like `CheckCDN`, `CheckCloud`, `CheckWAF`, and `CheckDomainWithFallback` that also resolve DNS and check CNAME suffixes. The CLI wraps this with input/output handling, filtering, and JSON output. The codebase is well-structured, with clear separation between core logic, data generation, and CLI runner. It is actively maintained by ProjectDiscovery and used in their security scanning ecosystem.
sqlmap is an automated penetration testing tool that detects and exploits SQL injection vulnerabilities in web applications. Its core functionality includes database fingerprinting, data extraction (tables, columns, users, passwords), file system read/write, OS command execution, and out-of-band exfiltration via DNS or ICMP. The architecture is a modular monolith: a central controller orchestrates DBMS-specific plugins (30+ databases), injection technique engines (boolean blind, error-based, UNION, time-based, stacked queries, DNS, OData, SPARQL, JWT, NoSQL, etc.), and tamper scripts for WAF bypass. The tool exposes both a CLI (sqlmap.py) and a REST API (sqlmapapi.py). External dependencies are minimal—most third-party libraries are vendored (chardet, colorama, beautifulsoup, pydes, fcrypt). The codebase demonstrates deep knowledge of SQL dialects, HTTP protocol handling, and security research, with extensive offline test suites and deterministic test harnesses. Notable technical strengths include pure-Python protocol clients (TDS, Kerberos, gRPC-Web), disk-spilling data structures (BigArray), and a safe JSON serializer that replaces pickle. Drift risks include remnants of Python 2 compatibility shims, bundled crypto implementations, and static fingerprinting data that may lag behind new DBMS versions.
This is a Go library for detecting the MIME type of files using magic number signatures. It implements a hierarchical detection tree rooted at 'application/octet-stream', allowing precise identification of over 200 file formats without any external dependencies. The library provides three detection entry points (byte slice, reader, file path) and supports concurrency via atomic and mutex locks. It includes custom parsers for CSV, JSON, OLE2/CDF, and MP3 frames, all optimized for performance and zero-copy where possible. The codebase is extensively tested with unit tests, fuzzing, and benchmarks, and is actively maintained with CI/CD, code scanning, and dependency automation. It is a standalone library with no runtime dependencies beyond the Go standard library.
Sunone Aimbot is an AI-powered aimbot for first-person shooter games that uses YOLO models to detect players and heads in real-time screen captures. The system captures frames via MSS, BetterCam, or OBS, processes them with Ultralytics YOLO, identifies targets (prioritizing heads unless disabled), calculates mouse movement to aim at targets, and optionally shoots automatically. It features a modular architecture with separate threads for capture, visualization, overlay, shooting, and hotkey monitoring. A helper API and React-based UI provide configuration management, model training/exporting, and testing capabilities. The aimbot supports multiple input methods including standard mouse, GHUB, Razer, and Arduino devices.
This repository provides the official browser language detection plugin for i18next. It implements a modular strategy pattern where each detector (cookie, querystring, localStorage, sessionStorage, navigator, htmlTag, path, subdomain, hash) is a self-contained module with a consistent interface. The main `Browser` class orchestrates detection by iterating through a configurable order of detectors, filters out XSS vectors, and optionally converts detected language codes. The code is well-structured, tested, and production-grade; the cookie detector in particular includes a robust RFC-compliant serialization function. Everything is browser-native with no heavy dependencies beyond i18next itself.
Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
This repository is a curated 'awesome list' of threat detection and hunting resources. It does not contain any executable code, application logic, or data pipelines. The content is purely a markdown document (README.md) and its HTML equivalent, along with a small number of PDF guides. The repository functions as an index of links to external tools (e.g., osquery, Sigma, HELK), datasets (e.g., Mordor, BOTS), frameworks (MITRE ATT&CK), blogs, videos, and training resources. It is a static, non-functional reference directory. While it serves as a valuable starting point for security professionals, it has no software architecture, no entry points, no data flows, and no reusable code components. Its value lies in curation and organization rather than engineering.