WebHackersWeapons is a curated, YAML-driven knowledge base and static documentation generator for web hacking and bug bounty tools, rather than a runnable application. Its core truth layer is 530+ weapons/*.yaml files, each defining a tool's name, URL, description, category, type, platform, language, and tags. These files are transformed by Ruby ERB scripts into a generated README and categorized pages by language and vulnerability tag, with schema validation enforced by scripts/validate_weapons.rb and CI via GitHub Actions. The repository behaves as a structured dataset with a small ETL pipeline: YAML metadata -> validated catalog -> Markdown cross-reference pages.
This is a comprehensive command-line tool and self-hosted web server for network reconnaissance, written entirely in Bash. It performs ASN lookups, BGP statistics, RPKI validation, IP geolocation, IP reputation checks (via StopForumSpam, IPQualityScore, GreyNoise), Shodan InternetDB scanning for open ports and vulnerabilities, AS path tracing with detailed hop information, and more. The architecture is a monolithic Bash script (~7000 lines) that integrates numerous public APIs (RIPEStat, Team Cymru, pWhois, PeeringDB, CAIDA, ipinfo.io, ip-api, Cloudflare Radar, etc.) and command-line tools (mtr, whois, jq, curl, ncat). It can run in interactive mode, JSON output mode (as an API), or as an HTTP server (using ncat) that generates HTML reports with clickable links and a bookmarklet for browser integration. The code is well-structured for a shell script, with extensive error handling, caching of API responses, and support for API tokens to enhance functionality. While it is not modular in a traditional sense (everything is in one file), it demonstrates high craftsmanship in Bash and is actively maintained.
OneForAll is a comprehensive subdomain enumeration and reconnaissance tool designed for security researchers and penetration testers. It aggregates subdomains from over 60 passive sources (certificate transparency logs, DNS datasets, search engines, threat intelligence feeds, and web crawlers), performs active brute-forcing via massdns, and enriches results with DNS resolution, HTTP probing, CDN detection, wildcard filtering, and subdomain takeover risk assessment. The tool is built as a modular Python CLI application, with each data source implemented as an independent plugin inheriting from base classes in `common/`. Output is stored in a SQLite database and can be exported to CSV, JSON, XLSX, and other formats. While primarily an application, the repository also includes curated data files (subdomain wordlists, CDN CIDR ranges, cloud service fingerprints) that are valuable for security research.
iKy (I Know You) is a modular OSINT (Open Source Intelligence) aggregation platform built with FastAPI, Celery, Redis, and an Angular frontend. The system ingests a username or email and concurrently executes 26+ parallel tasks across social media, data breaches, search engines, and dark web sources, returning a structured JSON contract (module, param, validation, raw, graphic, profile, timeline, tasks) consumed by a visual graph/timeline UI. Key architectural patterns include a dynamic module registry that maps route names to Celery task paths, a decorator-based task wrapper (@iky_task) that centralizes dev-mode golden-file bypass, error classification, and performance logging, and a pluggable search provider orchestration layer. The codebase demonstrates a strong separation of concerns between API routing, task execution, and data enrichment, but suffers from fragile scraping logic (LinkedIn RSC parsing, TikTok SSR regex), heavy reliance on browser session cookies, and several deprecated external APIs (Twitter v1.1, FullContact). The project is actively maintained with an extensive test suite (~4K lines) and Docker Compose deployment, though many tests are heavily mocked and may not detect real API drift.
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
This repository contains only documentation and configuration files (README, CONTRIBUTING, issue templates, .gitignore) with no actual source code present. The README describes SpiderSuite as a cross-platform web crawler for security professionals, but the codebase itself is empty in this snapshot. No functional analysis is possible. The repository appears to be a stub or the source code is hosted elsewhere. Given the absence of any executable or library code, this repository provides no reusable software assets.