WebSec0
Grades a site’s TLS setup and HTTP security headers, and explains how to fix what it finds.
Tools for the work.
Open source tools I build for web security, reconnaissance and the repetitive parts of research.
LANGUAGESShare of public tools
- Go4
- Ruby2
- Java1
- JavaScript1
- PHP1
Detective
Recon pipeline: subdomains, DNS, CDN detection, ports and web services, streamed to your API.
Hookd
Interaction server capturing out-of-band DNS, HTTP and SMTP callbacks through ephemeral hooks.
ScopesExtractor
Syncs and tracks scope changes on YesWeHack, HackerOne, Intigriti and Bugcrowd programs.
BurpToNats
Burp Suite extension that publishes every HTTP request it processes to a NATS queue.
FastRecon
Maps what a domain exposes: live hosts, open ports and HTTP services, as one JSON report.
SimpleProxy
Lightweight PwnFox alternative for Chrome: colours your requests per browser profile.
VulnLab
Intentionally vulnerable web app for security training, pentest practice and tool testing.
Certstream
Real-time Certificate Transparency monitor that matches wildcards and probes new hosts.
0 RESULTS
No tools match this search and language.
IN PROGRESS
In the lab.
Private projects I use day to day in my own research.
Fingerprinter
High-performance web technology detection engine.
GoPrivateRecon
All-in-one reconnaissance platform to map and monitor attack surfaces.
GoPrivateWordPress Plugins Auditor
WordPress plugin security analyzer that detects vulnerabilities with active fuzzing.
PHPPrivateInfosecBrain
Personal offensive security knowledge base.
MarkdownPrivate
MORE ON GITHUB
View full profile Scripts, dotfiles, and minor utilities are available in the public repositories.