Pinned Loading

1. overstep overstep Public

   Matrix-driven authorization testing for HTTP APIs and MCP tool-calls. Turns an access-control matrix into positive & negative tests that catch BOLA, BFLA, BOPLA, privilege escalation and authorizat…

   Python 2

2. rcekit rcekit Public

   Prove RCE, don't guess it — an RCE detection & confirmation toolkit for authorized pentesting. Point it at a URL or captured HTTP request and get a proof-backed "confirmed" verdict across command i…

   Python 13 2

3. HeaderHawk HeaderHawk Public

   Evidence-driven scanner for HTTP request-header vulnerabilities — Host header injection, SSRF, confirmed cache poisoning, access-control bypass, open redirects and virtual-host discovery. Signal ov…

   Python 4 2

4. sshfinder sshfinder Public

   Know every SSH service on your network, whether it meets your standard, and what changed overnight. Discovers SSH on any port, audits crypto and auth, gates CI with an exit code, and diffs against …

   Python 3

5. gdos gdos Public

   GraphQL DoS resilience scanner — verify your GraphQL endpoint is hardened against denial-of-service amplification attacks (depth, aliasing, batching, introspection, and more).

   Python 1