projects

bruteforce-lists

Wordlists for brute-forcing specific services — built up over years of engagements rather than scraped from generic collections.

My-Shodan-Scripts

Collection of scripts for Shodan searches — finding exposed services, buckets and misconfigured systems at scale.

keywords

Keyword list for hunting exposed secrets and keys, mixed from Travis-style leaks and keywords seen in Kubernetes secrets.

All-in-One-WP-Migration-Backup-Finder

Finds exposed All-in-One WP Migration backup files on target domains — the backups that leak a whole site's database and uploads.

Jira-Scan

Scanner for CVE-2017-9506 — the Jira SSRF that exposed private server keys at major companies.

cve-2020-0688

Proof-of-concept for the Exchange control panel viewstate deserialisation vulnerability.

ssrf-finder

Pass a list of URLs containing FUZZ and it checks whether a potential SSRF response comes back.

AWS-Scanner

Scans a list of websites for CloudFront distributions and S3 buckets — the tool behind a few of my disclosures.

bugbountydork

Google dork collection and automation aimed at bug bounty targets.

mass-s3-bucket-tester

Tests lists of S3 buckets for directory listings enabled and upload permissions.

docker-ssh-honey

SSH honeypot in Docker — watch what attackers do the moment they land on a box.

open-redirect

Open redirect finder — feeds it candidate URLs and flags the ones that bounce.

cloud-cidr

Current AWS, Azure and Google Cloud IP CIDR ranges — handy for scoping cloud-facing targets.

mcp-web-browser

Advanced web browsing server for the Model Context Protocol, powered by Playwright — headless browser control through a secure API.