~/hackyfeed $

RevOK is a cybersecurity tool designed to simulate malicious targets for testing security scanners and software that processes attacker-controlled data. Its core feature, the "stub" component, allows users to listen for incoming requests and serve crafted attack responses based on customizable templates and substitution lists. Notably, RevOK has been utilized to identify critical vulnerabilities, including XSS to RCE bugs in Metasploit Pro, highlighting its effectiveness in researching and weaponizing security scanner vulnerabilities.

NextSploit is a command-line utility for detecting and exploiting the Next.js vulnerability identified as CVE-2025-29927. It automates the process of identifying vulnerable Next.js versions and attempts to exploit the flaw by bypassing middleware protections, potentially allowing unauthorized access to restricted content. Notable features include automated version detection using Wappalyzer, mass URL scanning capability, and an integrated Chrome browser launch for exploitation tests.

This repository provides a structured introduction to offensive techniques that exploit neural networks, focusing on areas such as bug hunting, malware injection, and information extraction. Each technique is accompanied by practical exercises to facilitate hands-on learning. Notable features include detailed instructions for setting up a Python environment and using various ML tools, as well as a diverse range of attack scenarios aimed at enhancing understanding of security vulnerabilities in neural networks.

The network-vulnerability-scanner is a tool designed to identify vulnerabilities within networked systems by analyzing hosts and services for known security flaws. Its primary use case is to enable network administrators and security professionals to assess the security posture of their network infrastructure. Notable features include support for various network protocols, customizable scanning options, and detailed reporting on discovered vulnerabilities and recommended mitigations.

The Cracked Nessus in Docker repository provides a Dockerized version of the Nessus vulnerability scanner, facilitating easy setup and deployment. Its primary use case is to enable security professionals to run Nessus scans in a contained environment, allowing for quick administration and updates via simple Docker commands. Notable features include automated installation through Docker, a straightforward user interface accessed via a web browser, and commands for migrating data between container versions.

LMAP (Large Language Model Mapper) is an out-of-the-box evaluation tool for large language models (LLMs), aimed at aiding developers and compliance teams in assessing security and safety risks associated with LLM deployments. It includes features such as universal HTTP access for various LLMs, a user-friendly GUI for ease of use, multi-objective testing capabilities, automated and manual redteaming modules, and customizable datasets for specific applications. Additionally, LMAP streamlines the evaluation process by generating formatted reports compatible with CI/CD pipelines, ensuring comprehensive vulnerability assessment pre- and post-deployment.

The Harbor Scanner Adapter for Aqua Enterprise serves as a bridge between the Harbor scanning API and Aqua Enterprise's scanning capabilities, enabling vulnerability scanning of container images stored in the Harbor registry. Notable features include its implementation of the Pluggable Scanners API, which allows for ad hoc scanning and the generation of vulnerability reports, while also requiring specific version dependencies and configurations to function properly. The adapter does not provide visibility or enforcement for Aqua's image assurance policies, which must be managed via the Aqua Management Console.

The Firmware Analysis Toolkit (FAT) is designed to assist security researchers in analyzing and identifying vulnerabilities within IoT and embedded device firmware by providing automated firmware emulation capabilities based on Firmadyne. Key features include the ability to run firmware images in a controlled environment without the need for a PostgreSQL database, as well as streamlined setup and interaction via Python scripts, enabling real-time testing and network interface configuration.

Bsqli is a customizable vulnerability scanner designed to identify SQL injection vulnerabilities using a targeted payload list, ensuring high accuracy with minimal false positives. It is optimized for rapid scanning across multiple hosts and supports multithreading for enhanced performance. Notable features include support for both single URL and file-based target inputs, as well as options for output management and SSL verification settings.

BeeXSS is an automated tool that identifies Blind XSS (Cross-Site Scripting) vulnerabilities in web applications by scanning URL parameters and injecting payloads. Its notable features include the use of customizable Blind XSS-specific payloads, headless browsing via Selenium WebDriver for efficient scanning, and detailed reporting of potential vulnerabilities. The tool is intended for educational and ethical penetration testing purposes, ensuring users have permission to test the targeted applications.

ZENVORA VulnScan v2.0 is a comprehensive vulnerability scanner designed for web applications, focusing on detecting various security issues such as SQL injection, cross-site scripting (XSS), and command injection. It includes features like anonymity levels through Tor and ProxyChains, automated report generation in TXT and JSON formats, and an extensive list of tests for common vulnerabilities. This tool is intended for authorized use only, highlighting the importance of ethical scanning practices.

A lightweight active and passive scanner that combines the advantages of local and distributed models, supports dynamic external plugin import, and is dedicated to exploring web black-box vulnerabilities.

XSSniper is an advanced open-source XSS vulnerability scanner designed for professional security testing. It features asynchronous scanning for enhanced performance, a comprehensive payload library tailored to the latest CVEs, and sophisticated WAF bypass techniques. Notable capabilities include intelligent context-aware detection, smart parameter discovery, and detailed vulnerability reporting for effective analysis of web applications.

WPRecon is an advanced WordPress reconnaissance and vulnerability scanning tool designed for security engineers to identify vulnerabilities, misconfigurations, and information disclosure in WordPress installations. It utilizes a YAML-driven template architecture that facilitates easy extensibility, rapid deployment as a single binary, and features such as high-performance parallel scanning, a diverse library of over 150 templates, and multi-format output options. Notable capabilities include automatic retries for failed requests, comprehensive HTTP operations, and a variety of matchers and extractors for efficient data retrieval and analysis.

wp-taint-scan is a specialized static analysis tool designed to detect genuine vulnerabilities in WordPress plugins using a native Go-based taint analysis engine. It enables users to scan multiple versions of plugins in parallel and offers features such as detailed source-to-sink dataflows, version diffs to track changes in vulnerabilities, and a thorough understanding of the WordPress security model, significantly reducing false positives. Notable vulnerability classes include SQL injections, XSS, path traversal, and missing authorization issues, making it an essential tool for enhancing WordPress security.

Worm GPT Core is an advanced adversarial prompt delivery framework designed for AI researchers and cybersecurity professionals to evaluate and exploit vulnerabilities in large language models (LLMs). It automates the delivery of jailbreak prompts and features innovative mechanisms for alignment evasion, multi-threaded prompt execution, and seamless integration with both commercial and local LLMs. The tool aims to enhance penetration testing capabilities within AI systems while ensuring zero telemetry and optimized performance.

Wordfence CLI is a high-performance security scanner designed for detecting PHP malware and vulnerabilities in WordPress installations. Written in Python, it operates in a multi-process environment, allowing for parallel scans, scheduling, and integration with other commands via input and output piping. Notable features include the ability to scan directories for malware and vulnerabilities efficiently, as well as comprehensive installation and configuration documentation.

Ward is a specialized security scanner for Laravel applications that performs targeted security checks by understanding the application's structure, including routes, models, and configuration files. Notable features include live vulnerability lookups against the Packagist advisory database, comprehensive checks for common misconfigurations, and the ability to generate detailed reports on security findings, making it a valuable tool for both development environments and CI/CD pipelines.

VulnHawk is an AI-powered code security scanner designed to identify vulnerabilities that conventional SAST tools like Semgrep and CodeQL may overlook, particularly those related to business logic flaws where the absence of expected patterns is key. It employs contextual code analysis by comparing similar components across a codebase, facilitating the detection of security issues without the need for extensive configuration or custom rules. Notably, it supports various AI backends, integrates easily into CI/CD pipelines, and operates entirely locally or privately using options like Ollama.

VulnScout is a security analysis tool designed for whitebox security reviews, offering offline quick scans and evidence-backed verification for identifying vulnerabilities within codebases. It provides features such as shared findings documentation, various output formats for reports, and support for multiple deep analyzers, making it suitable for integration into continuous integration workflows. Notably, it operates without requiring a remote service and includes capabilities for auditing, verifying findings, and generating structured reports.

VISTA (Vulnerability Insight & Strategic Test Assistant) is an AI-driven extension for Burp Suite that enhances security testing through real-time traffic analysis and intelligent vulnerability detection. It offers notable features such as an interactive AI advisor for context-aware testing suggestions, customizable analysis templates, and a comprehensive payload library, enabling pentesters to conduct faster and more systematic assessments. Additionally, VISTA supports multiple AI providers, including OpenAI and Azure, to tailor its guidance to user needs.

Vigil is an open-source, AI-powered security operations platform designed for comprehensive vulnerability management, incident response, and compliance tracking within a unified Express.js framework. Key features include six built-in scanners (Nmap, Nuclei, Trivy, Nikto, OpenSSL, DNS), 20 autonomous agents for parallel operations, and support for custom AI integrations, all while maintaining a lightweight architecture without external dependencies. The platform also offers advanced functionalities like role-based access control, two-factor authentication, and an encrypted credential vault for enhanced security.

SmartCode-Guard is an AI-powered static code analysis tool specifically designed to identify security vulnerabilities in Java source code. It integrates a modular architecture that includes a parser for extracting code structure, a rule engine for detecting common security anti-patterns, and an AI engine for deep semantic analysis, making it highly effective for enforcing secure coding practices and allowing for customization through extensible security rules. Notable features include static rule enforcement and intelligent analysis for preparing code snippets for LLM-based audits.

ShubhamWebScript is a Python-based website vulnerability checker designed for educational and ethical hacking purposes, allowing users to assess the security of web applications through automated scanning of parameter-based URLs. It detects common vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Remote Code Execution indicators, while also performing server header fingerprinting. The tool features both single and bulk URL scanning capabilities, making it beginner-friendly and suitable for learning basic web security practices.

Secrover is an open-source security auditing tool that generates comprehensive, human-readable security reports, focusing on vulnerabilities in dependencies, code, and domains. Its notable features include easy setup via YAML configuration, automation capabilities with scheduled scans and GitHub Actions, cross-platform compatibility, and flexible report exports to various remote destinations. The tool aims to provide actionable insights for users, making it accessible for both technical and non-technical audiences.