165 Repositories
PHP security-scanner Libraries
FilterGuard is a simple PHP library for sanitizing data. It provides methods to sanitize strings, integers, floats, booleans, arrays, and objects. The library helps protect against common security vulnerabilities such as XSS and SQL injection.
FilterGuard FilterGuard is a simple PHP library for data sanitization. It provides methods to sanitize strings, integers, floats, boolean values, arra
A Laravel 9 package that allows you enforce security of your artisan commands by authenticating users before running.
Introduction This package allows you as a developer to restrict who can and cannot run artisan commands, especially in a production environment. For e
Staged Payloads from Kali Linux - Part 1,2 of 3
PT Phone Home As penetration testers, we often come up with creative methods to deliver and execute our payloads, such as staged payloads. A staged pa
BjyAuthorize - Acl security for ZF2
BjyAuthorize - Acl security for ZF2 Deprecated This package is now officially deprecated and will not receive any future updates or bug fixes. As long
PHP shells that work on Linux OS, macOS, and Windows OS.
PHP Reverse Shell Just a little refresh on the popular PHP reverse shell script pentestmonkey/php-reverse-shell. Credits to the original author! Works
🔒 a simple login screen done in php with connection to mysql
login.php What is a login system? login (derived from the English log in) or logon or signin, is the process to access a restricted computer system ma
Application with SQL Injection vulnerability and possible privilege escalation
Application with SQL Injection vulnerability and possible privilege escalation. Free vulnerable app for ethical hacking / penetration testing training.
A Laravel package to scrub sensitive information that breaks operational security policies from being leaked on accident or not by developers.
A Laravel package to scrub sensitive information that breaks operational security policies from being leaked on accident or not by developers.
🔒 Laravel validation rule that checks if a password has been exposed in a data breach.
🔒 Laravel Password Exposed Validation Rule This package provides a Laravel validation rule that checks if a password has been exposed in a data breac
⚡ Php snippets, random stuff, demos, functions, fast message system, agnostic and framework free - 100% compactible ;) ⚡
⚡ Php8 FPM Nginx Fast, Scripts, Pearls & Treasures 🚀 Want to run and test asap ? docker-compose up -d phpgit_php8;ip=$(docker-machine ip default);ech
Github Action which checks Security issues scanning package manager files
security-checker-action This action checks your composer.lock for known vulnerabilities in your package dependencies. Inputs lock optional The path to
Strong cryptography tools and password hashing
laminas-crypt 🇷🇺 Русским гражданам Мы, участники Laminas, родились и живем в разных странах. У многих из нас есть друзья, родственники и коллеги как
HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.
TYPO3 HTML Sanitizer ℹ️ Common safe HTML tags & attributes as given in \TYPO3\HtmlSanitizer\Builder\CommonBuilder still might be adjusted, extended or
Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101
Fix Major Security Vulnerability on PrestaShop Websites 🚀 CVE-2022-31101 detector and fixer! A newly found exploit could allow remote attackers to ta
Use Ciphersweet in your Laravel project
In your project, you might store sensitive personal data in your database. Should an unauthorised person get access to your DB, all sensitive can be read which is obviously not good.
Audit your PHP version for known CVEs and patches
PHP Version Audit PHP Version Audit is a convenience tool to easily check a given PHP version against a regularly updated list of CVE exploits, new re
Disable direct access to your sites /wp-login.php script, plus user notifications based on actions.
WordPress Login Locker Disable direct access to your sites /wp-login.php script plus user notifications based on actions. Package Installation (via Co
An auto software that collects, scans and sends automatic instagram users
Instagram Advanced User Finder V1.0.0 With this PHP script, you can find users on Instagram and message them. Feedback Türkçe Get Key every week, you
Web page performance/seo/security/accessibility analysis, browser-less for PHP
Web page performance/seo/security/accessibility analysis, browser-less for PHP
WebVulScan - a web application vulnerability scanner
WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities.
CrimeFlare - This tools can help you to see the real IP behind CloudFlare protected websites
CrimeFlare is a useful tool for bypassing websites protected by CloudFlare WAF, with this tool you can easily see the real IP of websites that have been protected by CloudFlare. The resulting information is certainly very useful for conducting further penetration testing, and analyzing websites with the same server.
A dockerized PHP application containing some file upload vulnerability challenges (scenarios)
File Upload Vulnerability Scenarios (Challenges) This repository is a dockerized PHP application containing some file upload vulnerability challenges
Added Laravel functionality to Enlightn Security Checker
Added Laravel functionality to Enlightn Security Checker. Adds a command to check for, and optionally emails you, vulnerabilities when they affect you.
PHP library for Two Factor Authentication (TFA / 2FA)
PHP library for Two Factor Authentication PHP library for two-factor (or multi-factor) authentication using TOTP and QR-codes. Inspired by, based on b
Create and validate signed URLs with a limited lifetime
This package can create URLs with a limited lifetime. This is done by adding an expiration date and a signature to the URL.
Passbolt - Open source password manager for teams
Passbolt - Open source password manager for teams
The Security component provides a complete security system for your web application.
Security Component The Security component provides a complete security system for your web application. It ships with facilities for authenticating us
Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes
Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes
A multitool library offering access to recommended security related libraries, standardised implementations of security defences, and secure implementations of commonly performed tasks.
SecurityMultiTool A multitool library offering access to recommended security related libraries, standardised implementations of security defences, an
Programmatically create and render barcodes as images or in PDFs
laminas-barcode 🇷🇺 Русским гражданам Мы, участники Laminas, родились и живем в разных странах. У многих из нас есть друзья, родственники и коллеги к
Secure package for WP CLI, built to provide an easier way of securing your WordPress installation
wp-cli/secure-command Official website: Hackthewp.com Manages common security aspects of WordPress. Supports nginx and Apache. Basic Usage This packag
PHP Secure Headers
Secure Headers Add security related headers to HTTP response. The package includes Service Providers for easy Laravel integration. Version Installatio
Laminas\Console is a component to design and implement console applications in PHP.
laminas-console This package is abandoned and will receive no further development! We recommend using laminas/laminas-cli. Laminas\Console is a compon
A wrapper of voku/anti-xss for Laravel
Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campb
Symfony bundle that provides Cross Site Request Forgery (CSRF or XSRF) protection for client-side applications
CSRF Cookie Bundle This Symfony bundle provides Cross Site Request Forgery (CSRF or XSRF) protection for client-side applications requesting endpoints
Google Two-Factor Authentication Package for Laravel
Google2FA for Laravel Google Two-Factor Authentication Package for Laravel Google2FA is a PHP implementation of the Google Two-Factor Authentication M
Javascript code scanner to use with gettext/gettext
Javascript code scanner to use with gettext/gettext
MISP - Threat Intelligence Sharing Platform
MISP is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and ICT professionals or malware reversers to support their day-to-day operations to share structured information efficiently.
Damn Vulnerable PHP Application (DVPA)
Damn Vulnerable PHP Application (DVPA) - It is Lab Written in The PHP lang, Which Contains PHP Type Juggling - RCE Challenges
An utility component for XML usage and best practices in PHP
An utility component for XML usage and best practices in PHP
Regexp Security Cheatsheet
Regexp Security Cheatsheet Research was done to find "weak places" in regular expressions of Web Application Firewalls (WAFs). Repository contains SAS
A full-featured home hosted Cloud Drive, Personal Assistant, App Launcher, File Converter, Streamer, Share Tool & More!
A Fully Featured home-hosted Cloud Storage platform and Personal Assistant that Converts files, OCR's images & documents, Creates archives, Scans for viruses, Protects your server, Keeps itself up-to-date, and Runs your own AppLauncher!
PHP code scanner to use with gettext/gettext
PHP code scanner to use with gettext/gettext
A laboratory for learning secure web and mobile development in a practical manner
A laboratory for learning secure web and mobile development in a practical manner. Build your lab By provisioning local environments via docker-compos
Create and update progress bars in different environments
Create and update progress bars in different environments
Laminas\Text is a component to work on text strings
laminas-text This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering
laminas-xml2json provides functionality for converting XML structures to JSON
laminas-xml2json This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Stee
Create cryptographically secure pseudo-random numbers, and manage big integers
laminas-math This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering
All in one tool for Information Gathering and Vulnerability Scanning
All in one tool for Information Gathering, Vulnerability Scanning and Crawling. A must have tool for all penetration testers
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that may be needed.
🔒 Password Exposed Helper Function - Check if a password has been exposed in a data breach.
🔒 Password Exposed Helper Function This PHP package provides a password_exposed helper function, that uses the haveibeenpwned.com API to check if a p
Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable.
Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.
laminas-di integration for laminas-servicemanager
laminas-servicemanager-di This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Techn
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code.
PHP Secure Configuration Checker
PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on C
CMS auto detect and exploit.
BadMod auto exploit tool Version 2.0 Fixed colors bug Fixed permissions bug Added new option to scan single target Added new option to scan joomla & w
Clear all your logs in [linux/windows] servers 🛡️
Log-killer Log Killer is tool for [Linux/Windows] Servers This tool will delete all your logs just download the tool and run it on the server if your
WPHunter A Wordpress Vulnerability Scanner
WPHunter Tool ☣ WPHunter A Wordpress Vulnerability Scanner You can use this tool on your wordpress website to check the security of your website by fi
provides a nested object property based user interface for accessing this configuration data within application code
laminas-config This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steeri
laminas-memory manages data in an environment with limited memory
Memory objects (memory containers) are generated by the memory manager, and transparently swapped/loaded when required.
Secure WordPress login with two factor authentication
This plugin allows you to secure your WordPress login with two factor authentication. The users will have to enter a one time password every time they log in.
This package is considered feature-complete, and is now in security-only maintenance mode
laminas-soap This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering
Security CSRF (cross-site request forgery) component provides a class CsrfTokenManager for generating and validating CSRF tokens.
Security Component - CSRF The Security CSRF (cross-site request forgery) component provides a class CsrfTokenManager for generating and validating CSR
Security issues for Magento have left a big question mark in the community of online stores
Magento 2 Security extension FREE. Security extension gives store owners the ability to detect the IP addresses that are intentionally attacking their store at any given time. Therefore, they have timely measures to prevent this issue such as blocking those IP addresses or sending warning emails to store owners.
Laravel Nova Ban simplify blocking and banning Eloquent models.
Laravel Nova Ban Introduction Behind the scenes cybercog/laravel-ban is used. Contents Installation Usage Prepare bannable model Prepare bannable mode
sqlscan is quick web scanner for find an sql inject point
sqlscan sqlscan is quick web scanner for find an sql inject point. not for educational, this is for hacking. use sitemap for best result Simple to use
Security Component - Guard
The Guard component brings many layers of authentication together, making it much easier to create complex authentication systems where you have total control.
Simple PHP templating system for user editable templates.
Simple template Simple PHP templating system for user editable templates. Idea Most applications need to render templates that insert safely treated v
This is my attempt at building a decent SVG sanitizer in PHP. The work is laregely borrowed from DOMPurify.
svg-sanitizer This is my attempt at building a decent SVG sanitizer in PHP. The work is laregely borrowed from DOMPurify. Installation Either require
Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campbell/security-core
Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campb
A simple way to know if you are on the list of major security breaches like "HIBP", but it is specific for Iran.
Leakfa.com A simple way to know if you are on the list of major security breaches like "HIBP", but it is specific for Iran. Service content This produ
FalconOne Lite is an Open Source solution deployed and updated on a daily basis to help prevent terror and crime globally
FalconOne Lite is an Open Source solution deployed and updated on a daily basis to help prevent terror and crime globally. By using advanced tools, functions and stealth strategies, FalconOne community is focused on making a friendly and fast solution for effective results.
Library that offers Input Filtering based on Annotations for use with Objects. Check out 2.dev for 2.0 pre-release.
DMS Filter Component This library provides a service that can be used to filter object values based on annotations Install Use composer to add DMS\Fil
List of Magento extensions with known security issues.
Magento Vulnerability Database List of Magento 1 and 2 integrations with known security issues. Objective: easily identify insecure 3rd party software
「🌎」Web Exploration Laboratory
「 🌎 」About Web Exploration Laboratory The Web Exploration Laboratory (WEL) is a project created for people just entering the information security bus
Scanner, signatures and the largest collection of Magento malware
Improved malware scanner now available Good news: our opensource malware scanner "mwscan" has been succeeded by a much better one called eComscan. It
A Magento community sourced security pre-flight checklist.
Magento Security Checklist This is a community sourced checklist of security measures to take before launching your store. Think of it as a pre-flight
A htaccess boilerplate for all Magento Community installations. Features focus on speed, SEO and security.
magento-htaccess A htaccess boilerplate for all Magento Community installations. Features focus on speed, SEO and security. The file should be placed
Harden request headers, login interface and passwords to increase backend security.
JvMTECH.NeosHardening Package for Neos CMS Harden request headers, login interface and passwords to increase backend security. Installation composer r
A curated list of resources for learning about application security
Awesome AppSec A curated list of resources for learning about application security. Contains books, websites, blog posts, and self-assessment quizzes.
Your performance & security consultant, an artisan command away.
Enlightn A Laravel Tool To Boost Your App's Performance & Security Introduction Think of Enlightn as your performance and security consultant. Enlight
This package helps you to associate users with permissions and permission groups with laravel framework
Laravel ACL This package allows you to manage user permissions and groups in a database, and is compatible with Laravel v5.8 or higher. Please check t
A laboratory for learning secure web and mobile development in a practical manner.
A laboratory for learning secure web and mobile development in a practical manner. Build your lab By provisioning local environments via docker-compos
Collection of scripts, thoughts about CSP (Content Security Policy)
CSP useful, a collection of scripts, thoughts about CSP I'm testing and using CSP (Content Security Policy), and here are some thoughts, resources, sc
A PHP dependency vulnerabilities scanner based on the Security Advisories Database.
Enlightn Security Checker The Enlightn Security Checker is a command line tool that checks if your application uses dependencies with known security v
SЁCU is a public API to store self-destructing data payloads with url shortener and handle anonymous chat-rooms.
SЁCU Introduction SЁCU is a public API to store self-destructing data payloads. This repository includes only backend part using Laravel framework. Fr
Csrf Component provides Cross Site Request Forgery protection by comparing provided token with session token to ensure request validity.
Csrf Component Csrf Component provides Cross Site Request Forgery protection by comparing provided token with session token to ensure request validity
Serialize and deserialize PHP structures to a variety of representations
laminas-serializer This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical St
A kernel designed to run one and only one application in a virtualized environment
nanos Nanos is a new kernel designed to run one and only one application in a virtualized environment. It has several constraints on it compared to a
Docker images for Cyber_Security hakathon 2021.
This repository contains a set of vulnerable Docker images for attacking the container environment compiled for Cyber_Security hackathon 2021. Require
WPBruiser {no- Captcha anti-Spam} (forked, updated)
=== WPBruiser {no- Captcha anti-Spam} === Contributors: mihche, knutsp Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_
Matomo is the leading Free/Libre open analytics platform.
Matomo (formerly Piwik) - matomo.org Code Status Description Matomo is the leading Free/Libre open analytics platform. Matomo is a full-featured PHP M
Security advisories as a simple composer exclusion list, updated daily
Roave Security Advisories This package ensures that your application doesn't have installed dependencies with known security vulnerabilities. Installa
PHP frontend for security.symfony.com
SensioLabs Security Checker WARNING: Don't use this piece of software anymore as the underlying web service will stop working at the end of January 20
PHP Secure Headers
Secure Headers Add security related headers to HTTP response. The package includes Service Providers for easy Laravel integration. Version Installatio
Parse: A Static Security Scanner
Parse: A PHP Security Scanner PLEASE NOTE: This tool is still in a very early stage. The work continues... The Parse scanner is a static scanning tool
A static analysis tool for security
progpilot A static analyzer for security purposes Only PHP language is currently supported Installation Option 1: use standalone phar Download the lat
phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code
phpcs-security-audit v3 About phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in
HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.
TYPO3 HTML Sanitizer ℹ️ Common safe HTML tags & attributes as given in \TYPO3\HtmlSanitizer\Builder\CommonBuilder still might be adjusted, extended or
Exploiting and fixing security vulnerabilities of an old version of E-Class. Project implemented as part of the class YS13 Cyber-Security.
Open eClass 2.3 Development of XSS, CSRF, SQLi, RFI attacks/defences of an older,vulnerable version of eclass. Project implemented as part of the clas