JWT Attack Suite
None algorithm bypass (multiple variants) Algorithm confusion (RS256 -> HS256) JWK header injection with auto-generated keys kid injection (null file, path trav
Arsenal
Professional offensive security tools & exploit frameworks
98
Tools
12
Categories
Ransomware Encryption Analysis Tool
Entropy analysis with block-level mapping Encryption boundary detection Crypto algorithm identification (AES-ECB/CBC/CTR, ChaCha20, XOR, RC4, RSA-hybrid) Known
Blockchain Transaction Tracer
Bitcoin and Ethereum transaction tracing Recursive depth-based graph building Known exchange identification (Binance, Coinbase, Bitfinex) Mixer/tumbler detectio
AWS IAM Privilege Escalation Scanner
Caller identity enumeration User policy analysis (attached + inline + group) 18 known privesc pattern detection Assumable role discovery with trust policy analy
Kubernetes RBAC Auditor
ClusterRole analysis (wildcard, dangerous verbs) 8 known privesc pattern detection (exec, secrets, impersonate, bind) ClusterRoleBinding audit (SA with cluster-
Azure AD Password Sprayer
OAuth2, Autologon, and Graph API endpoints Smart lockout detection and cooldown MFA detection (AADSTS50076/50079) Account status detection (locked, disabled, ex
Docker Container Escape Exploits
Privileged mode detection and host mount exploit Docker socket detection and API abuse Host filesystem mount detection Cgroup escape (CVE-2022-0492) /proc core_
Terraform Security Scanner
15 built-in security rules (hardcoded creds, public S3, open SGs, wildcard IAM) Terraform plan JSON analysis for pre-deploy checks Severity-rated findings with
Cloud Metadata SSRF Exploiter
AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud 11 bypass techniques (decimal IP, hex, octal, URL encode, DNS rebind) Credential extraction and analysis
S3 Bucket Enumeration & Pillage
Smart bucket name generation from target base name Public listing, read, and authenticated access detection Sensitive file pattern matching (env, keys, configs,
GCP Service Account Key Finder
Metadata service enumeration (token, scopes, project) Environment variable scanning (7 known GCP vars) Filesystem search for SA JSON key files gcloud CLI config
CI/CD Pipeline Poisoning Kit
Auto-detect platform (Jenkins, GitLab, GitHub) Jenkins: Groovy console, credential extraction, job config analysis GitLab: CI/CD variable exposure, pipeline inj