Open-source offensive security & AI tooling ⚡
Building weird, powerful, self-hostable tools for security, defenders, researchers & curious humans.
| Tool | Description |
|---|---|
| BreachSQL | Fast SQL injection scanner with built-in exploitation — detect and extract in one command, across all major backends, with WAF evasion baked in. Drops into a Python pipeline. |
| StingXSS | Context-aware XSS scanner — reflected, DOM, stored, and confirmed browser XSS with WAF detection and evasion |
| PhaseAccess | Open-source IDOR / BOLA scanner. Goes beyond simple ID enumeration — it understands ownership, sessions, and evidence. |
| Tool | Description |
|---|---|
| GloomProxy | Open-source DAST platform built around a full MITM proxy — attack surface graph, distributed scanner plugins, auth orchestration, replay, workflows, and correlation in a single self-hosted UI. |
| OctoRig | Spin up realistic vulnerable environments for pentesting, security research, and offensive security training — with a single command. |
| GloamFire | Docker-native adversary simulation and detection validation framework for SOC teams, purple teams, homelabs, and detection engineers. |
| NyxStrike | AI-powered offensive security orchestration — connects LLM agents to real tools and runs full attack chains from recon to exploitation |
| Tool | Description |
|---|---|
| VaultRip | Post-exploitation credential harvesting and active attack engine. |
| Package | Description |
|---|---|
| commonhuman-core | Shared HTTP engine and web crawler — session management, injection helpers, BFS crawling, and passive recon primitives |
| commonhuman-payloads | Shared payload collections, encoders, and WAF signatures |
| commonhuman-cli | Shared CLI argument handling and output formatting |
🌿 Why?
Because security tooling should be:
- Transparent ✅
- Self-hostable ✅
- Fast ✅
- Experimental ✅
- Actually fun to use ✅