Pinned Loading

1. overstep overstep Public

   Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and privilege escalatio…

   Python 2 1

2. rcekit rcekit Public

   Confirmed means executed. An RCE detection & confirmation toolkit for authorised pentesting — point it at a URL or a captured request and every finding comes back with the tier it earned. Nothing i…

   Python 14 2

3. pentest-navgrid pentest-navgrid Public

   WSTG tells you what to cover. This tells you what the tests inside each line actually are: the procedure, the oracle that separates a real result from the thing that imitates it, and where a succes…

   Python 3

4. HeaderHawk HeaderHawk Public

   Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with …

   Python 5 2

5. sshfinder sshfinder Public

   Know every SSH service on your network, whether it meets your standard, and what changed overnight. Discovers SSH on any port, audits crypto and auth, gates CI with an exit code, and diffs against …

   Python 3

6. gdos gdos Public

   GraphQL DoS resilience scanner — verify your GraphQL endpoint is hardened against denial-of-service amplification attacks (depth, aliasing, batching, introspection, and more).

   Python 1