A multi-cloud IAM enumeration CLI that discovers effective permissions across AWS, GCP and Azure — 400+ AWS services, 4000+ GCP permissions and 2000+ Azure operations, all via safe read-only methods.
Paste a HuggingFace or GitHub access token to see its permissions, the accounts it reaches and the repositories it can change. The token is read in your browser and sent only to the service it belongs to.
Engineered to detect and help mitigate vulnerabilities in Docker — secrets, CVEs and misconfigurations across containers and images. Presented at BlackHat USA 2025, Asia 2025 and MEA 2024.
A Firebase misconfiguration detection toolkit that gives bug bounty hunters unparalleled precision. Co-presented at BlackHat Asia 2025 and Europe 2024.
A free serverless alternative to Burp Suite Collaborator. Catch SSRF and blind XSS callbacks — set it up once and it keeps handling requests with no further configuration.