Links
AddYour subtitles deserve metadata. Sublogue adds it.
Sublogue injects IMDb/RT ratings, plot, cast, and runtimes into your SRTs — and scrubs out the rubbish while it’s there. Zero timing drift.
Grype + Rummage = Grummage.
Grummage is an interactive terminal frontend to Grype.
Related contents:
- Own proxy database creates the attack from the whole world, which makes it much more difficult to protect against
- Efficient on a large number of targets simultaneously
- A variety of different methods, both "classic" and proprietary ones
- Frequent automatic updates without user intervention
The Burp extension helps you to find authorization bugs. Just navigate through the web application with a high privileged user and let the Auth Analyzer repeat your requests for any defined non-privileged user. With the possibility to define Parameters the Auth Analyzer is able to extract and replace parameter values automatically. With this for instance, CSRF tokens or even whole session characteristics can be auto extracted from responses and replaced in further requests. Each response will be analyzed and tagged on its bypass status.
AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.
Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests.
A tool that adds small enhancements to Claude Code.
- Reduced interruptions: Auto-handles permission dialogs based on configurable rules
- Flexible control: Rulesets define which actions to allow automatically
- Tool management: Toolsets configure which tools Claude can use
- Enhanced visibility: System notifications keep you informed
Email parser for browser and serverless environments.
postal-mime is an email parsing library that runs in browser environments (including Web Workers) and serverless functions (like Cloudflare Email Workers). It takes in a raw email message (RFC822 format) and outputs a structured object containing headers, recipients, attachments, and more.
Nextgen PostgreSQL Pooler.
PostgreSQL pooler and proxy (like PgBouncer) with support for sharding, load balancing, failover and mirroring.
Self-hosted homelab infrastructure visualizer — interactive network diagram with live status monitoring.
Homelable is a self-hosted infrastructure visualization solution. It provides a network scanning feature to accelerate the identification of machines and services deployed on your local infrastructure.
Homelable also offers a healthcheck system (WIP) through multiple methods (ping/TCP, /health API, etc.) to get a global overview of online/offline services.
Related contents:
Multi level grouping indicators for tables.
The command-not-found module is a feedback provider plugin for PowerShell. This feedback provider depends on the command-not-found utility, which is often available on Linux by default, to provide suggestions when a native command cannot be found.
bash also calls the command-not-found utility to provide suggestions when a command cannot be found. But this feedback provider plugin does more than that, thanks to the command-line predictor feature in PowerShell. It also implements the ICommandPredictor interface and serves as a predictor. When the resulted feedback contains actionable items, such as commands to run, they will be used as predictive suggestions to streamline the user's command-line experience.
A free (but better?) alternative to Obsidian Publish.
A no-brainer solution to turning your Obsidian PKM into a Zola site.
LLM Vulnerability Scanner.
Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction.
Related contents:
Modern credential testing tool in pure Go.
Fast, zero-dependency credential testing tool in Go. Brute force SSH, MySQL, PostgreSQL, Redis, MongoDB, SMB, and 20+ protocols. Hydra alternative with native fingerprintx/naabu pipeline integration.
Brutus is a multi-protocol authentication testing tool designed to address a critical gap in offensive security tooling: efficient credential validation across diverse network services. While HTTP-focused tools are abundant, penetration testers and red team operators frequently encounter databases, SSH, SMB, and other network services that require purpose-built authentication testing capabilities.
Gato, or GitHub Attack Toolkit, is an enumeration and attack tool that allows both blue teamers and offensive security practitioners to identify and exploit pipeline vulnerabilities within a GitHub organization's public and private repositories.
Open-Source API Security Testing Framework.
API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates.
Hadrian is an open-source API security testing framework that detects OWASP API Top 10 vulnerabilities in REST, GraphQL, and gRPC APIs. It uses role-based authorization testing and YAML-driven templates to automatically find broken object-level authorization (BOLA), broken function-level authorization (BFLA), broken authentication, and other critical API security flaws — without writing custom test code.
LLM Service Fingerprinting Tool.
Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 30+ other AI services in seconds.
Julius is an LLM service fingerprinting tool for security professionals. It detects which AI server software is running on network endpoints during penetration tests, attack surface discovery, and security assessments.
Unlike model fingerprinting tools that identify which LLM generated text, Julius identifies the server infrastructure: Is that endpoint running Ollama? vLLM? LiteLLM? A Hugging Face deployment? Julius answers in seconds.
Related contents:
MCP security testing framework for evaluating Model Context Protocol server vulnerabilities.
A Model Context Protocol (MCP) server built with FastMCP that provides various tools including Claude AI integration, text injection capabilities, and server information utilities. It is definitely super secure, you should definitely send confidential data through it, and definitely take everything it says as fact.
Related contents:
Attack Surface Discovery & OSINT Reconnaissance Tool.
Organizational asset discovery tool with 20+ plugins covering certificate transparency, passive DNS, and all 5 Regional Internet Registries.
Pius is an open-source attack surface discovery tool written in Go. Given a company name, it maps the complete external attack surface: domains, subdomains, and IP ranges (CIDRs). Pius queries certificate transparency logs, all five regional Internet registries (ARIN, RIPE, APNIC, AFRINIC, LACNIC), passive DNS databases, WHOIS/RDAP, BGP tables, and more through 24 discovery plugins.
High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 459 detection rules with live credential validation.
A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.
Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog.
API Discovery and Specification Generation Tool.
API discovery tool that maps attack surfaces from captured traffic and generates specs for REST, GraphQL, SOAP, and WebSocket APIs
Vespasian discovers API endpoints by observing real HTTP traffic and generates API specification files from those observations. It captures traffic through headless browser crawling or imports it from existing sources (Burp Suite XML exports, HAR files, and mitmproxy dumps), then classifies requests, probes discovered endpoints, and outputs specifications in the native format for each API type: OpenAPI 3.0 for REST, GraphQL SDL for GraphQL, and WSDL for SOAP services.
Related contents:
HTTP client for PostgreSQL, retrieve a web page from inside the database.
Why is this running?
witr exists to answer a single question:
Why is this running?
When something is running on a system—whether it is a process, a service, or something bound to a port—there is always a cause. That cause is often indirect, non-obvious, or spread across multiple layers such as supervisors, containers, services, or shells.
Tim lets you write simple templates that uses JavaScript's familiar dot notation. You pass in a JavaScript object that contains all the relevant strings, and they are then substituted into the template. For example:
Emora is an OSINT tool like sherlock but with a GUI, which search for accounts by username across social networks.
Emora allows you to search for accounts by username across social networks. Inspired by tools like Sherlock, Emora provides a user-friendly graphical interface to ease the usage and navigation through the results.
🚀 A React Framework for building extensible drag and drop page editors Craft.js solves this problem by modularising the building blocks of a page editor. It ships with a drag-n-drop system and handles the way user components should be rendered, updated and moved - among other things. With this, you'll be able to build your own page editor exactly how you want it to look and behave.
Clearer API for PHP Attributes and Reflection.
A local AI-powered DLP solution.
PrivacyFirewall is a local-first PII and secrets firewall for AI tools like ChatGPT, Claude, and Gemini.It blocks risky paste events, warns as you type, and (optionally) uses a lightweight on-device Transformer model for deeper PII detection.
Privastead is a privacy-preserving home security camera solution that uses end-to-end encryption
macOS CLI for OCR and searchable PDFs using Apple's Vision framework.
A macOS command-line tool that reads text from images and PDFs, and creates searchable PDFs. Runs entirely on your Mac with Apple's Vision framework; nothing is uploaded.
What's the best JavaScript minifier?
🏃♂️🏃♀️🏃 JS minification benchmarks: babel-minify, esbuild, terser, uglify-js, swc, google closure compiler, tdewolff/minify, oxc-minify
This is the Docker stack to set up a fully functional AgentJ antispam system at a glance.
Terminal flow field screensaver with Perlin noise, Braille rendering, particles, and 24-bit ANSI color.
Related contents:
Go CLI and Library for quickly mapping organization network ranges using ASN information.
Navigate the CVE jungle with ease.
Navigate the Common Vulnerabilities and Exposures (CVE) jungle with ease using CVEMAP, a command-line interface (CLI) tool designed to provide a structured and easily navigable interface to various vulnerability databases.
A next-generation crawling and spidering framework
Quickly discover exposed hosts on the internet using multiple search engines.
uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with automation in mind, so you can query it and utilize the results with your current pipeline tools.
PuzzleFS is a next-generation container filesystem.
Puzzlefs is a container filesystem designed to address the limitations of the existing OCI format. The main goals of the project are reduced duplication, reproducible image builds, direct mounting support and memory safety guarantees, some inspired by the OCIv2 design document.
Whisky is the simplest, framework agnostic, CLI tool for managing and enforcing a php project's git hooks across an entire team.
The blackbox exporter allows blackbox probing of endpoints over HTTP, HTTPS, DNS, TCP, ICMP and gRPC.
Prometheus exporter for AWS CloudWatch - Discovers services through AWS tags, gets CloudWatch metrics data and provides them as Prometheus metrics with AWS tags as labels.
Universal, model-agnostic operating harness for AI agents (Claude, Codex, Gemini, …) — a lean core + work-type profiles assembled by one setup script.
Zero shot vulnerability discovery using LLMs. A tool to identify remotely exploitable vulnerabilities using LLMs and static code analysis.
Vulnhuntr leverages the power of LLMs to automatically create and analyze entire code call chains starting from remote user input and ending at server output for detection of complex, multi-step, security-bypassing vulnerabilities that go far beyond what traditional static code analysis tools are capable of performing.
Related contents:
Apple TV, Amazon Fire TV, Chromecast, Homatics, NVIDIA Shield, onn., Roku, Xiaomi Mi, and Android TV remote control card for Home Assistant.
Firemote is a custom Home Assistant card that is capable of controlling your media devices directly from any Home Assistant dashboard. The Firemote dashboard remotes are designed to look just like your physical remote controls, but they also contain TONS of customization options to choose from!
LLM playground to experiment with local models and build fine-tuning datasets and benchmarks.
A playground that gives you full control over the contents of a chat conversation: add, remove and edit messages (system, user and assistant) and shape the flow of the conversation to be exactly what you need.
Active Directory Group Policy Security Analyzer.
A security assessment tool for analyzing Active Directory Group Policy Objects (GPOs) to identify misconfigurations and vulnerabilities.
GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory Group Policy Objects (GPOs). It automates security checks and provides detailed reports on potential vulnerabilities, helping administrators secure their environments.
Simple open source self-hosted file sharing solution. It's an alternative to paid services like Dropbox, WeTransfer.
Push docker images directly to remote servers without an external registry.
Unregistry is a lightweight container image registry that stores and serves images directly from your Docker daemon's storage.
The included docker pussh command (extra 's' for SSH) lets you push images straight to remote Docker servers over SSH. It transfers only the missing layers, making it fast and efficient.
Ollama Automated Security Intelligence Scanner.
🛡️ An AI-powered security auditing tool that leverages Ollama models to detect and analyze potential security vulnerabilities in your code.
Advanced code security analysis through the power of AI
Related contents:
A jQuery plugin to add CSS classes based on direction of mouse entrance or exit of an element.
Pubs brings your bibliography to the command line.
Pubs organizes your scientific papers together with their bibliographic data and provides command line access to basic and advanced manipulation of your library.
WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices. It also warns of the disconnection of "always connected" devices
Wireguard client that exposes itself as a socks5 proxy.
wireproxy is a completely userspace application that connects to a wireguard peer, and exposes a socks5/http proxy or tunnels on the machine. This can be useful if you need to connect to certain sites via a wireguard peer, but can't be bothered to setup a new network interface for whatever reasons.
A TypeScript framework for building MCP servers capable of handling client sessions.
Easy web app creator.
A Web App Manager, written in rust with GTK and beautiful Adwaita. With Web App Hub you can manage your Web App with ease. All apps will have their own icon and can be isolated from the normal normal browser profile.
Related contents:
IDA Pro Binary Diffing Engine.
DiffRays is a research-oriented tool for binary patch diffing, designed to aid in vulnerability research, exploit development, and reverse engineering.
Relate contents: