Most of these exist because I needed the answer on an engagement and nothing gave it to me. The newer ones share a rule: measure what a credential, agent, or network can reach, and never widen it in the process. Last-commit dates come from GitHub at build time.
Read-only blast-radius triage for leaked credentials. Pipe any credential-bearing text at it; it recognizes over a hundred credential types, runs read-only recon with each, and ranks what they actually reach. Dry-run by default, and a guard test keeps every module read-only.
Built with the Puck Security folks.
Autonomous, read-only endpoint investigation via MCP. A Go MCP server validates every command against a policy engine and writes an audit log before fanning out to Rust agents that never write to disk.
Built with Puck Security.
Finds credentials in screenshots, saves them to your secret manager, and irreversibly redacts them from the image. Local, offline, OCR-based, and it re-OCRs the result to prove the secret is gone.
Built at Adversis.
A realistic ChatGPT-style assistant with a seeded inbox, built to demonstrate indirect prompt injection live: poisoned documents hijack the model and the exfiltration shows up in an attacker console beside it. For training rooms, not production.
Built at Adversis.
A security auditor for Tailscale configurations. Scans a tailnet for 57 misconfigurations, overly permissive ACLs, and best-practice violations, with an interactive fix mode.
Built at Adversis.
A fast, cross-platform scanner for the obvious and not-so-obvious signs that a package, repo, or install script is malicious. Patterns borrowed with thanks from GuardDog.
Built at Adversis.
Burp Suite extension for analyzing Next.js Server Actions, the server-side functions identified by hash IDs and Next-Action headers.
Built at Adversis.
Burp plugin that parses React Server Component responses to extract interesting data.
Built at Adversis.
Discovers gRPC services and methods on a server that doesn’t support reflection and for which you have no proto files. Then lets you call them.
Built at Adversis.
Dynamically extracts GraphQL queries and mutations from loaded JavaScript.
Built at Adversis.
Finds Electron apps, checks their ASAR integrity settings, and lists native .node modules.
Built at Adversis.
Decrypts Jenkins credential stores offline. The companion write-up is in the archive.
Queries Shodan and Censys for an organization’s exposed hosts in one pass.
Audits a Box.com tenant for files and folders that were shared with the world by accident.
Built at Adversis.
Small Go utilities from engagements, mostly Windows API wrappers.
Brute-forces 389 Directory Server PBKDF2 hashes. Led to a Hashcat module.
Merged pull requests to Sliver, Metasploit (the Jenkins credential gather module), and Hashcat.
A few CVEs, including a command injection in Adobe Acrobat Reader (CVE-2021-28634) and an Informacast JMX misconfiguration that gave remote code execution.