This repository is the curl project, consisting of the libcurl library and the curl command-line tool. libcurl is a client-side URL transfer library supporting a wide range of protocols including HTTP, HTTPS, FTP, FTPS, SCP, SFTP, SMTP, POP3, IMAP, LDAP, MQTT, WebSocket, and many more. The curl tool provides a powerful command-line interface for making network requests with extensive options for authentication, SSL/TLS configuration, proxy support, output formatting, and scripting. The architecture is a classic C library with a public API (include/curl/) and a separate CLI tool (src/) that links against the library. Key entry points include curl_easy_perform() for synchronous transfers, curl_multi_perform() for asynchronous multiplexed transfers, and the curl command-line binary. Data flows involve URL parsing, DNS resolution (with support for c-ares, threaded, and DoH), connection establishment via a filter chain (TCP, TLS, HTTP/2, HTTP/3, SOCKS, etc.), protocol-specific handling, and response processing. External dependencies include OpenSSL, GnuTLS, wolfSSL, mbedTLS, Schannel, rustls for TLS; c-ares for async DNS; libssh2/libssh for SSH; nghttp2 for HTTP/2; ngtcp2 and quiche for HTTP/3; and various system libraries. The codebase is exceptionally well-structured, with a modular filter architecture, extensive test coverage (unit, integration, and HTTP test suites), and a strong emphasis on portability across Unix, Windows, macOS, and embedded platforms.
Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
Spring Security is a comprehensive authentication and authorization library for Spring-based applications, supporting both Servlet (MVC) and Reactive (WebFlux) stacks. In production, it intercepts HTTP requests via a configurable filter chain (SecurityFilterChain for servlet, WebFilterChain for reactive) to enforce authentication, session management, CSRF protection, security headers, CORS, and access control. It provides a pluggable architecture with core abstractions (AuthenticationManager, AuthorizationManager, SecurityContextHolderStrategy) and protocol-specific modules for OAuth2/OIDC, SAML2, LDAP, CAS, WebAuthn, Kerberos, and JWT. The library is configured via annotations (@EnableWebSecurity, @EnableMethodSecurity), a Kotlin DSL, or XML namespace, and integrates deeply with Spring's configuration and dependency injection. The architecture is modular: the 'core' module defines foundational interfaces (Authentication, GrantedAuthority, SecurityContext), 'web' implements servlet and reactive security filters, 'config' provides annotation-driven and XML configuration support, and protocol modules (oauth2, saml2, ldap, webauthn, cas) handle specific authentication/authorization flows. Key entry points include the HttpSecurity/ServerHttpSecurity builders, SecurityFilterChain, and method-security annotations (@PreAuthorize, @Secured). External dependencies include Spring Framework, Jackson (for serialization), Project Reactor (for reactive support), OpenSAML, and LDAP libraries. The codebase demonstrates strong engineering practices: extensive use of strategy, composite, and builder patterns; clean separation of servlet and reactive APIs; and a consistent Jackson mixin pattern for serialization of security objects.
Kanboard is a self-hosted, open-source project management application implementing the Kanban methodology. It provides a full web interface for managing tasks, projects, columns, swimlanes, subtasks, comments, tags, and time tracking, with drag-and-drop board interaction, automatic actions triggered by events, and extensive filtering/search capabilities. The architecture follows a custom MVC pattern with PHP controllers, models, and templates, using Pimple for dependency injection, PicoDb for database abstraction (supporting SQLite, MySQL, PostgreSQL, and MSSQL), and Symfony EventDispatcher for event-driven workflows. It includes a JSON-RPC API, CLI console commands, a plugin system, multiple authentication backends (LDAP, OAuth2, reverse proxy, TOTP), email notifications via SwiftMailer, and analytics (burndown, cumulative flow, lead/cycle time). The frontend uses jQuery and custom JavaScript components with charting via C3.js/D3.js. The codebase is well-structured with clear separation of concerns, extensive unit and integration tests, and a modular design that allows plugins to extend functionality. However, it is explicitly in maintenance mode (no new features, only bug fixes and community contributions), and several vendored libraries (SwiftMailer, PicoDb, JSON-RPC, etc.) may become outdated. The JavaScript layer relies on older patterns (jQuery, global namespace) and lacks a modern build pipeline. Configuration uses global constants rather than environment variables, and some areas show technical debt (e.g., mixed coding styles, deprecated PHP annotations). Despite these issues, the core architecture is solid, and many components (filter system, plugin installer, OAuth2 client, LDAP client, queue manager) are well-designed and potentially reusable in other PHP projects.
This repository contains a proof-of-concept exploit for CVE-2026-41089, a critical stack buffer overflow in the Windows Netlogon service via CLDAP (UDP 389). The poc.py script sends a malformed LDAP search request with an oversized username to trigger the vulnerability, causing LSASS to crash and the domain controller to reboot. The implementation includes correct BER/DER encoding primitives for LDAP packet construction, which can be reused in other projects requiring LDAP protocol handling.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.
This repository is the Python implementation of PowerView, a comprehensive Active Directory (AD) security assessment and exploitation tool. It provides a feature-rich CLI (with an interactive shell), a web-based UI (Flask + vanilla JS), and a Model Context Protocol (MCP) server for AI agent integration. The tool enumerates AD objects (users, groups, computers, GPOs, trusts, certificates, DNS, SMB shares, etc.), identifies security vulnerabilities (kerberoasting, AS-REP roasting, shadow credentials, ACL abuse, certificate template misconfigurations), and supports active exploitation (DACL modification, RBCD, coercion attacks, SMB file operations). It is designed for red team operations and AD security audits. The architecture is a monolith centered on a large `PowerView` class (in `powerview.py`) that orchestrates all commands and dispatches to specialized modules (e.g., `kerberoast.py`, `ca.py`, `exchange.py`, `ldapattack.py`). It supports both standard LDAP and a custom implementation of Microsoft's Active Directory Web Services (ADWS) protocol (SOAP over .NET Message Framing and NegotiateStream), enabling operations without conventional LDAP. The tool leverages Impacket for low-level Windows protocols (SMB, RPC, Kerberos) and includes a plugin system with decorator-based registration and before/after hooks. The web front-end offers interactive graph visualization, object exploration, and real-time command history, while the MCP server exposes AD operations to AI assistants. Key data flows involve LDAP/ADWS queries for object enumeration, SMB/RPC sessions for remote system interaction, and Kerberos tickets for authentication attacks. External dependencies include `ldap3` (forked), `impacket` (forked), `dsinternals`, `flask`, `werkzeug`, and client-side libraries (Cytoscape.js, Alpine.js, Tailwind CSS). The codebase is large and tightly coupled in places, but the custom ADWS implementation, plugin system, and vulnerability detection engine are notable achievements that could be extracted and reused.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
msldap is a Python library and CLI tool for interacting with Microsoft Active Directory via LDAP. It provides both a low-level async connection (MSLDAPClientConnection) and a high-level client (MSLDAPClient) with convenience methods for enumerating users, computers, groups, GPOs, trusts, and more. The library supports multiple authentication methods (NTLM, Kerberos, simple, SSPI), LDAPS, SOCKS proxy, and includes an interactive console client (msldap) and a BloodHound collector (msldap-bloodhound). It also features ADCS vulnerability scanning, shadow credentials, LAPS extraction, DNS record manipulation, and an LDAP relay server. The codebase is well-organized with a modular architecture, extensive test suite (offline and live interop tests), and several reusable components such as a custom ASN.1 packetizer, LDAP filter parser, and binary structure parser. However, it has some known bugs (7 registered in known_failures.yml), vendored dependencies (asciitree, aiocmd) that may drift from upstream, and a few code quality issues (typos, dead code). Overall, it is a solid, feature-rich tool for AD security assessments.
LiteOps is a lightweight, self-hosted CI/CD platform built with Django 4.2 (Python 3.9) and Vue 3 (Ant Design Vue). It provides project management, build task configuration, credential storage (GitLab tokens, SSH keys, kubeconfig), environment management, and notification robots (DingTalk, WeChat, Feishu). Builds are executed inside a Docker-in-Docker container that includes Java, Maven, Node, and kubectl, with real-time log streaming via Server-Sent Events (SSE). The system integrates with GitLab for webhook-triggered builds and branch/commit information, supports LDAP authentication, and enforces role-based permissions (function and data scopes). The frontend dashboard displays build statistics, trends, and recent builds using ECharts. The codebase is functional and actively developed, but exhibits several engineering weaknesses: no automated tests, threading for async build execution (no task queue), hardcoded secrets (admin password, database credentials), SHA256 password hashing (not bcrypt), and plaintext storage of GitLab tokens. The Docker image is large and requires privileged mode. Despite these issues, the system is suitable for small teams needing a simple, integrated CI/CD solution without external dependencies beyond GitLab and MySQL.