An extensible multilanguage static code analyzer.

Awesome PHP Security Resources 🕶🐘🔐

The framework that allows us to write PHP extensions using pure and safe Rust whenever possible.

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code

Modular & Open-Source Coverage-Guided Web Application Fuzzer for PHP

User Operations for Zend

A virtual machine for executing programs written in Hack.

A grey-box web application Fuzzer

Atropos: Effective Fuzzing of Web Applications for Server-Side Vulnerabilities

PHP parser written in Go

AST Metrics is a language-agnostic static code analyzer.

Taint Analysis for PHP

Taint is a PHP extension, used for detecting XSS codes

Experimental fuzzer for PHP libraries

Collection of vulnerable and fixed PHP synthetic test cases

This cheasheet is aimed at the CTF Players and Beginners to help them sort Hack The Box Labs on the basis of Operating System and Difficulty.

Using Socks4/5 or http proxies to make a multithreading Http-flood/Https-flood (cc) attack.

Beautiful and understandable static analysis tool for PHP

Hsuan-Fuzz: REST API Fuzzing by Coverage Level Guided Blackbox Testing

A PHP parser written in PHP

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!

A curated list of amazingly awesome Cybersecurity datasets

Testability Pattern Catalogs for SAST

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

This tool use fuuzzing to try to bypass unknown authentication methods, who knows...

TP-Framework: Testability Pattern Framework for SAST

DelugeProxy is a defence reverse proxy server with the aim of deceiving security scanners into thinking that the attack was successful for each tentative.