Pinned Loading

1. overstep overstep Public

   Matrix-driven authorization testing for HTTP APIs and MCP tool-calls. Turns an access-control matrix into positive & negative tests that catch BOLA, BFLA, BOPLA, privilege escalation and authorizat…

   Python 2

2. rcekit rcekit Public

   Prove RCE, don't guess it — an RCE detection & confirmation toolkit for authorized pentesting. Point it at a URL or captured HTTP request and get a proof-backed "confirmed" verdict across command i…

   Python 13 2

3. HeaderHawk HeaderHawk Public

   Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with …

   Python 5 2

4. sshfinder sshfinder Public

   Know every SSH service on your network, whether it meets your standard, and what changed overnight. Discovers SSH on any port, audits crypto and auth, gates CI with an exit code, and diffs against …

   Python 3

5. gdos gdos Public

   GraphQL DoS resilience scanner — verify your GraphQL endpoint is hardened against denial-of-service amplification attacks (depth, aliasing, batching, introspection, and more).

   Python 1