BishopFox

Adversary Emulation Framework

Never ever ever use pixelation as a redaction technique

Automating situational awareness for cloud penetration tests.

Extract URLs, paths, secrets, and other interesting bits from JavaScript

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

Convolutional neural network for analyzing pentest screenshots

A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

HTTP Request Smuggling over HTTP/2 Cleartext (h2c)

A collection of manifests that will create pods with elevated privileges.

Dylib injection for iOS 11.0 - 11.1.2 with LiberiOS and Electra jailbreaks

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

Utility to decrypt App Store apps on jailbroken iOS 11.x

Create your own vulnerable by design AWS penetration testing playground

Discover Exposed AI Services

RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities

Find cloud assets that no one wants exposed 🔎 ☁️

Search exposed EBS volumes for secrets

A ZigBee hacking toolkit by Bishop Fox

PoC code from DEF CON 25 presentation

The Rickmote Controller: Hijack TVs using Google Chromecast

RCE exploit for CVE-2023-3519

Companion labs to "An Exploration of JSON Interoperability Vulnerabilities"

A productionized greedy coordinate gradient (GCG) attack tool for large language models (LLMs)

Use LLMs for document ranking

Decrypt encrypted Fortienet FortiOS firmware images

Heavily-modified fork of David Buchanan's dlinject project. Injects arbitrary assembly (or precompiled binary) payloads directly into x86-64, x86, and ARM32 Linux processes without the use of...

Firecat is a penetration testing tool that allows you to punch reverse TCP tunnels out of a compromised network.

Safely detect whether a FortiGate SSL VPN instance is vulnerable to CVE-2023-27997 based on response timing

Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)

OSDP attack tool (and the Elvish word for friend)

Safely detect whether a FortiGate SSL VPN is vulnerable to CVE-2024-21762

Anti-Anti-Automation Framework

An auxiliary spellcheck dictionary that corresponds with the Bishop Fox Cybersecurity Style Guide

LLM Testing Findings Templates

Determine the running software version of a remote F5 BIG-IP management interface.

Creating attacks paths across management and data planes

Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908

A collaborative web exploitation framework.