Pinned Loading

1. overstep overstep Public

   Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and privilege escalatio…

   Python 2

2. rcekit rcekit Public

   Confirmed means executed. An RCE detection & confirmation toolkit for authorised pentesting — point it at a URL or a captured request and every finding comes back with the tier it earned. Nothing i…

   Python 13 2

3. pentest-navgrid pentest-navgrid Public

   WSTG tells you what to cover. Pentest NavGrid shows you the real tests inside each test case, and where a successful one may lead. Offline, self-contained, public alpha.

   Python

4. HeaderHawk HeaderHawk Public

   Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with …

   Python 5 2

5. sshfinder sshfinder Public

   Know every SSH service on your network, whether it meets your standard, and what changed overnight. Discovers SSH on any port, audits crypto and auth, gates CI with an exit code, and diffs against …

   Python 3

6. gdos gdos Public

   GraphQL DoS resilience scanner — verify your GraphQL endpoint is hardened against denial-of-service amplification attacks (depth, aliasing, batching, introspection, and more).

   Python 1