OWTF (Offensive Web Testing Framework) is a full-stack web application for automated and manual penetration testing. The Python/Tornado backend exposes a JWT-protected REST API for managing targets, sessions, plugin worklists, workers, reports, and proxy history, while the React/Redux frontend provides dashboards, data tables, plugin marketplace, and proxy controls. The application also includes a customizable intercepting HTTP/HTTPS proxy with SSL certificate generation, an interceptor chain for header/body/URL/delay modification, transaction history, a repeater, and live interception - comparable in scope to a Burp Suite-style tool. Execution is plugin-driven: built-in Python plugins covering web, network, and auxiliary tests, plus wrappers around external tools like Nikto and Arachni, are run by multiprocessing workers. Community plugins can be uploaded after AST-based static validation that blocks dangerous imports and execution patterns. The system stores plugin outputs, deduplicates them via SHA-256 fingerprints, tracks execution metrics, and supports HTML reporting. User authentication includes JWT, email verification, OTP, and admin role management. Architecturally, this is a monolith with modular managers and a REST API, not microservices. Deployment targets Docker Compose, Kubernetes, and cloud Terraform. The codebase contains genuinely reusable components: AST-based plugin validation, cross-platform file locking, output fingerprint deduplication, structured logging, and SQLAlchemy query helpers. However, it also carries significant legacy debt: old frontend patterns (React 16 class components, Redux 3, Redux-Saga 0.16), Python 2 remnants in scripts, hardcoded secrets in compose files, and several stub or placeholder external plugins. The repository is fundamentally an application rather than a data research project; bundled dictionaries and execution metrics serve the security workflow but do not define its primary character.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
A Debian-packaged Bash toolset that ports ParrotSec's anonsurf and pandora tools to Kali Linux. The anonsurf component makes the whole system use a Tor transparent proxy: it saves existing iptables rules, flushes them, redirects DNS to a local Tor DNSPort, forwards TCP/UDP/ICMP through Tor's TransPort on port 9040, excludes private and local networks, disables IPv6 through sysctl, and supports changing Tor identity. The pandora component is a shutdown service that drops kernel caches and scrubs RAM with sdmem from secure-delete. The repository is not a library or service; it is an installer plus a .deb source tree, with GitHub Actions that build the package and verify it installs in Kali rolling containers. The code is functional and has some good operational detail, including UID-based iptables owner rules, resolvconf vs. plain resolv.conf handling, and package maintainer scripts that swap torrc files. It is also rough around the edges: it is largely monolithic shell, has no unit tests for the iptables logic, relies on outdated actions/checkout@v2 CI actions, and the IPv6 re-enable function has a filename typo that checks /etc/sysctl.d/98-kali-anonsurf but removes /etc/sysctl.d/98-kali-anonsurf.conf, which can prevent IPv6 from being re-enabled after stop.
This repository contains a monolithic Python 2 CLI application for brute-force cracking of Facebook accounts. It provides a menu-driven interface that allows a user to log in with a Facebook access token or credentials, then attempt to crack the passwords of friends or specified user IDs using a hardcoded set of common passwords (e.g., '786786', 'Pakistan', first_name+786). The tool also includes features for extracting friend IDs, emails, and phone numbers via the Facebook Graph API, as well as automating post deletion, friend request acceptance, and unfriending. The architecture is tightly coupled, with global variables, repetitive code, and no separation of concerns. The main entry point is `wasi.py`, which calls `tlogin()` for authentication and then delegates to `.wasii.py` for the main menu and cracking logic. A secondary module `.opt.py` offers a variant with user-specified password lists. The code relies on deprecated Python 2 libraries (mechanize, urllib) and hardcoded Facebook API tokens, making it fragile and insecure. There are no tests, no modular design, and the code exhibits poor craftsmanship with minimal error handling and no reusability. The repository is a typical example of a low-quality hacking script popular in underground communities, with high technical drift due to Python 2 deprecation and likely outdated API endpoints.