alibaba / open-code-review
Secure, fast, efficient, battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible.
Z4nzu / hackingtool
ALL IN ONE Hacking Tool For Hackers
chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
mxssl / sre-interview-prep-guide
Site Reliability Engineer Interview Preparation Guide
Mr-xn / Penetration_Testing_POC
渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms
reddelexc / hackerone-reports
Top disclosed reports from HackerOne
jonaslejon / malicious-pdf
💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh
Safe3 / uusec-waf
Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.
cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
jhy / jsoup
jsoup: the Java HTML parser, built for HTML editing, cleaning, scraping, and XSS safety.
dromara / lamp-cloud
[灯灯]微服务中后台快速开发平台，支持jdk21、jdk17、jdk8，专注于多租户、开放平台解决方案，亦可作为普通项目（非SaaS架构）的基础开发框架使用，目前已实现插拔式数据库隔离、SCHEMA隔离、字段隔离 等租户隔离方案。
hahwul / dalfox
🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.
leizongmin / js-xss
Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
lets-mica / mica
Spring Cloud 微服务开发核心工具集。工具类、验证码、http、redis、ip2region、xss 等，开箱即用。 🔝 🔝 记得右上角点个star 关注更新！
mganss / HtmlSanitizer
Cleans HTML to avoid XSS attacks
C0nw0nk / Nginx-Lua-Anti-DDoS
A Anti-DDoS script to protect Nginx web servers using Lua with a HTML Javascript based authentication puzzle inspired by Cloudflare I am under attack mode an Anti-DDoS authentication page protect yourself from every attack type All Layer 7 Attacks Mitigating Historic Attacks DoS DoS Implications DDoS All Brute Force Attacks Zero day exploits Social Engineering Rainbow Tables Password Cracking Tools Password Lists Dictionary Attacks Time Delay Any Hosting Provider Any CMS or Custom Website Unlimited Attempt Frequency Search Attacks HTTP Basic Authentication HTTP Digest Authentication HTML Form Based Authentication Mask Attacks Rule-Based Search Attacks Combinator Attacks Botnet Attacks Unauthorized IPs IP Whitelisting Bruter THC Hydra John the Ripper Brutus Ophcrack unauthorized logins Injection Broken Authentication and Session Management Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Cross-Site Scripting (XSS) Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring Drupal WordPress Joomla Flash Magento PHP Plone WHMCS Atlassian Products malicious traffic Adult video script avs KVS Kernel Video Sharing Clip Bucket Tube sites Content Management Systems Social networks scripts backends proxy proxies PHP Python Porn sites xxx adult gaming networks servers sites forums vbulletin phpbb mybb smf simple machines forum xenforo web hosting video streaming buffering ldap upstream downstream download upload rtmp vod video over dl hls dash hds mss livestream drm mp4 mp3 swf css js html php python sex m3u zip rar archive compressed mitigation code source sourcecode chan 4chan 4chan.org 8chan.net 8ch 8ch.net infinite chan 8kun 8kun.net anonymous anon tor services .onion torproject.org nginx.org nginx.com openresty.org darknet dark net deepweb deep web darkweb dark web mirror vpn reddit reddit.com adobe flash hackthissite.org dreamhack hack hacked hacking hacker hackers hackerz hackz hacks code coding script scripting scripter source leaks leaked leaking cve vulnerability great firewall china america japan russia .gov government http1 http2 http3 quic q3 litespeedtech litespeed apache torrents torrent torrenting webtorrent bittorrent bitorrent bit-torrent cyberlocker cyberlockers cyber locker cyberbunker warez keygen key generator free irc internet relay chat peer-to-peer p2p cryptocurrency crypto bitcoin miner browser xmr monero coinhive coin hive coin-hive litecoin ethereum cpu cycles popads pop-ads advert advertisement networks banner ads protect ovh blazingfast.io amazon steampowered valve store.steampowered.com steamcommunity thepiratebay lulzsec antisec xhamster pornhub porn.com pornhub.com xhamster.com xvideos xvdideos.com xnxx xnxx.com popads popcash cpm ppc
nette / latte
☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
hackademix / noscript
The popular NoScript Security Suite browser extension.
foxssake / netfox
Addons for building multiplayer games with Godot
r0075h3ll / Oralyzer
Python tool that probes websites for open redirection via headers, JavaScript, and meta-tag refresh, pulls candidate URLs from the Wayback Machine, and checks CRLF injection and DOM XSS.
renniepak / CSPBypass
CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.
chushuai / wscan
Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.
Ishanoshada / GDorks
Google Dork List - Uncover the Hidden Gems of the Internet ( There are at least 320+ categories ) + Web App
voku / anti-xss
㊙️ AntiXSS | Protection against Cross-site scripting (XSS) via PHP
MindPatch / scant3r
ScanT3r - Module based Bug Bounty Automation Tool ( use Lotus instead github.com/bugBlocker/lotus )
xssnick / tonutils-go
TON SDK Library in pure Golang for interacting with The Open Network ecosystem using native protocols, such as ADNL, RLDP and etc.
w3c / trusted-types
A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
kkomelin / isomorphic-dompurify
Use DOMPurify on server and client in the same way
tuwukee / jwt_sessions
XSS/CSRF safe JWT auth designed for SPA
anmolksachan / TheTimeMachine
Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not
OWASP / owasp-java-encoder
Contextual output encoding for Java 8+: HTML, JavaScript, CSS, XML and URI components. Zero-dependency core with optional JSP and Jakarta adapters.
Arcanum-Sec / wraith
WRAITH — a modern browser-hooking framework (BeEF + blind-XSS successor) for red teams, researchers, and educators. For authorized security testing, research & education only.
SecFathy / xss-specialist
KEV-gated continual-learning XSS specialist with execution-authoritative browser verification
xsser / dig
By spoofing the domain name response information of dig to deceive DeepSeek/GLM into implementing automated penetration testing for you.通过修改dig的域名返回信息欺骗让deepseek /glm为你实现自动化的渗透测试
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
lxsssssss / pdf-translate
—
zack0x01 / XSS.pdf-Credential-Harvesting-PDF
A proof-of-concept PDF file designed for authorized security testing of PDF upload functionality and PDF viewer behavior, including XSS and credential-harvesting scenarios.
DeathShotXD / Comment2Shell
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
Boreas37 / CVE-2026-64638-PoC-XSS2Shell-
XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template
The-XSS-Rat / BountySkiller
—
davidbuenov / dbv-md-reader
Lector nativo de Markdown (.md) para Windows, Linux y macOS, ultra-ligero de lectura y edición, construido con Rust + Tauri v2. TOC, búsqueda, Mermaid, GFM completo, Always on Top, multi-ventana, auto-recarga y sanitización XSS. Sin Electron.
armourinfosec / Offensive-Web-Application-Security
A lab-driven course on breaking web applications and explaining how to fix them — 491 notes, 36 reproducible labs, mapped to OWASP WSTG and the PortSwigger Top 10 Web Hacking Techniques.
ovasendin / markdown_preview_editor
Self-hosted, privacy-first Markdown editor & live preview. Documents never leave your browser: no backend, no tracking, strict CSP, sandboxed preview.
codexss / Proxi
A clean and lightweight Chrome proxy switcher. 一个简洁的 Chrome 代理切换扩展。
m0m0x01d / strata
See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as a 7-layer cross-section. 17 labs, attacker & defender modes, AI-authorable.
B3nac / Android-Reports-and-Resources
A big list of Android Hackerone disclosed reports and other resources.