Adversarial testing
for teams that ship.

Bulk URL Checker

Takes a list of URLs from CSV, XLSX or TXT, hits them all in one run, and records status code, response headers and timing for each. Produces a detailed report, with optional automated PoC screenshots per URL — which turns an afternoon of manual triage into a single click.

• csv / xlsx / txt input
• header & status capture
• PoC screenshots

Malicious File Generator

Embeds test payloads into arbitrary file types to exercise file-upload controls end to end — extension allow-lists, MIME and magic-byte validation, AV and sandbox scanning, and what the application does with a file once it lands. Built for authorised assessments against my own lab and in-scope targets.

• polyglot / embedded payloads
• content-type validation
• OWASP file upload

RLO Filename Spoof Generator

Generates filenames carrying the Unicode right-to-left override character (U+202E) to demonstrate extension spoofing — invoice<U+202E>fdp.exe renders as invoiceexe.pdf in most file pickers and mail clients while still executing as a binary. Useful for proving that an upload filter reads the displayed name rather than the real one, and for phishing-awareness demos.

• U+202E
• MITRE T1036.002
• filter bypass PoC

File Size Inflator

Pads any file type with dummy data up to a target size on demand. Written for the boring half of upload testing: finding the real size ceiling, checking whether the limit is enforced server-side or only in JavaScript, and seeing how WAF body caps, timeouts and storage quotas behave at the boundary.

• arbitrary file types
• exact target size
• limit & quota testing

Ad Blocker Extension

A request-filtering extension for Chromium-based browsers that removes roughly 80% of ad placements on the sites I use daily. Built mostly to understand the filtering pipeline from the inside — rule matching, request interception and what the browser will and won't let an extension block.

• request filtering
• rule matching
• ~80% block rate

Meeting Attendance Recorder

Captures the attendee roster of a live browser-based meeting — every participant who joined, the total head count, and how long each person actually stayed — then exports it as a clean attendance register. Replaces scrolling the participant panel and counting by hand at the end of a session.

• join / leave timestamps
• per-person dwell time
• exportable register

Aegis Security Platform

Scanners find; Aegis proves. It ingests Nuclei, ZAP, Burp and generic scanner output, dedupes the same issue across tools, then verifies every finding with deterministic, non-destructive checks before AI triage writes a word — the AI can never set the verification status. Evidence-grade reports in Markdown, HTML and JSON, with a retest loop that diffs fixed, persistent and regressed findings.

• cross-tool dedupe
• deterministic verification
• AI triage
• retest diffing

GitHub repo

AdaptiveChat

A chatbot that sets its own temperature for every message — facts run cold, brainstorming runs hot — behind input and output guardrails, orchestrated as a LangGraph state machine. Upload documents and answers come from your files with cited sources. Bring your own API key in the browser; nothing is stored server-side.

• self-adjusting temperature
• LangGraph orchestration
• document RAG
• bring-your-own-key

GitHub repo Live demo

Distributed Task Queue

A production-shaped task queue in pure Python standard library — no dependencies. Priority and FIFO leasing with owner-checked ack, fail and heartbeat, exponential-backoff retries into a dead-letter queue, delayed jobs and atomic JSON persistence with at-least-once delivery semantics.

• priority leasing
• dead-letter queue
• backoff retries
• zero dependencies

GitHub repo

Cloud Misconfiguration Scanner

Finds the exposures that turn into breaches: unauthenticated public-access checks plus offline analysers for AWS, Azure, GCP and OCI policies, security groups and firewalls. Runs against a whole fleet from one targets file and exports a JSON report.

• AWS · Azure · GCP · OCI
• public exposure checks
• fleet mode

GitHub repo

Zero-Dependency Security Tools

A shelf of small, single-purpose tools that run anywhere Python does: HTTP security headers checker, TLS certificate inspector, DNS and email-auth checker, JWT analyzer, CORS misconfiguration checker, bulk URL checker, port scanner lite and more. Every tool ships with offline unit tests.

• zero dependencies
• offline tests
• MIT licensed

Browse the repositories

AppSec Field Notes

Original notes from real engagements, written to be used: an HTTP security headers audit, a file upload testing checklist, a JWT audit walkthrough, SPF, DKIM and DMARC explained from the attacker's side, and how RLO filename spoofing hides a file's true type.

• HTTP headers
• file uploads
• JWT
• email auth

GitHub repo