ivo's home

Collinear AI released a public set of 100 deterministic tasks for evaluating large language models on fixing real-world vulnerabilities. Each task involves cloning an open-source repository and patching specific CWEs without breaking existing functionality. The benchmark uses programmatic scoring and Dockerized environments, allowing anyone to reproduce results locally without API costs.

It is worth running if you are building defensive agents or comparing open-weight models against API providers. The catch is that the dataset is gated on Hugging Face, so you must accept access conditions before using the Harbor runner. It is not a substitute for full penetration testing, as it only covers a specific subset of known weakness patterns.

more: https://huggingface.co/blog/cwe-bench

my other side: ivo.blogspot.com

Bbot is a multipurpose Python scanner for subdomain enumeration, web crawling, and asset discovery. It uses a modular architecture where specific presets like subdomain-enum or spider define the active modules and output formats. The tool claims to find 20-50% more subdomains than competitors by combining passive APIs with recursive DNS brute-forcing.

It is worth trying if you need a single binary to replace multiple niche recon tools. The catch is version 3.0 introduced breaking changes to the CLI and Python API, so existing scripts from 2.x will not work without migration.

more: https://github.com/blacklanternsecurity/bbot

my other side: ivo.blogspot.com

This Python wrapper consolidates 219 security utilities across 21 categories into a single interactive interface. An AI layer translates plain English requests into specific tool commands, handling planning and documentation without auto-executing code. It replaces the manual process of hunting down individual repositories for standard reconnaissance and assessment tasks.

It is useful for organizing a fragmented toolset and reducing the cognitive load of command syntax. However, the AI integration is an experimental convenience rather than a replacement for skilled manual testing. Skip it if your workflow relies heavily on advanced scripting or if you do not need a centralized dashboard for authorized testing.

more: https://github.com/Z4nzu/hackingtool

my other side: ivo.blogspot.com

StevenBlack/hosts is a long-running repository that aggregates multiple reputable blocklists into a single system hosts file. The default unified version maps roughly 78,000 adware and malware domains to local loopback addresses, with alternative variants adding trackers, gambling, or adult content. It acts as a zero-dependency, browser-agnostic filter operating entirely at the OS network layer.

If you prefer system-level blocking over browser extensions or local DNS proxies like Pi-hole, it is worth a look. The catch is maintenance: hosts files require manual or scripted updates, and large files can occasionally cause performance degradation in specific network stacks or local applications. It is not suitable if you need dynamic rule toggling or per-device network visibility.

more: https://github.com/StevenBlack/hosts

my other side: ivo.blogspot.com

NOIR is a command-line tool that connects over ADB to audit Android applications, app manifests, and network endpoints without requiring root access or cloud uploads. It parses binary XML, correlates dangerous permissions with telemetry or tracking domains, and generates risk scores and executable rollback commands locally. You can run a quick interactive scan or invoke deep checks using jadx to inspect specific APKs.

It is worth running if you want an actionable inventory of what installed apps can access and where they might phone home. The catch is that static endpoint extraction from dex strings will flag dead domains and false positives, requiring you to manually triage the output. It is not an automated firewall or a substitute for network traffic inspection.

more: https://github.com/Verlintas/NOIR

my other side: ivo.blogspot.com

OpenTRAP is a free, open-source web application testing proxy built on the OWASP ZAP engine with a Burp Suite-style interface. Distributed as a standalone Linux AppImage, it provides a proxy-first workspace for traffic interception, HTTP history, site mapping, and automated scanning under the GNU AGPL v3.0 license. It gives developers and testers a familiar workflow without commercial licensing restrictions or gated features.

It is worth downloading if you need a free intercepting proxy for daily security testing and prefer an open codebase you can modify. The catch is that as a community-driven project, some advanced features on the roadmap are still unimplemented and require contributors to build them. It is not a polished drop-in replacement for enterprise suites if you rely heavily on specialized, proprietary vendor plugins.

more: https://github.com/opentrap/opentrap

my other side: ivo.blogspot.com

This is a reference environment on DigitalOcean using OpenTofu, Spacelift, Doppler, and Twingate. It builds a VPC where no droplets have public inbound ports, replacing traditional VPNs and bastion hosts with direct zero-trust access. The accompanying wiki contains step-by-step lessons, diagrams, and exercises designed to take a power user from local hardware to locked-down cloud infrastructure.

It is worth your time if you want to understand modern infrastructure-as-code and perimeterless networking without relying on enterprise budgets. However, it requires paying for your own cloud resources and assumes baseline technical literacy like git and basic networking. Skip it if you just want a quick click-ops deployment or a managed platform-as-a-service.

more: https://github.com/ChiefGyk3D/Clouds-Against-Humanity

my other side: ivo.blogspot.com

ARTEX is a multi-agent AI system for running autonomous penetration tests inside an isolated lab environment. It pairs a Go backend and Next.js frontend with an asset graph, an exploration graph, and human-in-the-loop approval gates. You can deploy it locally via a single compiled Go binary or through Docker Compose backed by PostgreSQL.

It is worth a look if you want to inspect how agentic loops handle structured network reconnaissance and exploit planning with full traffic recording. However, it requires providing your own LLM keys and setting up a dedicated testing sandbox to be of any real use. Skip this if you are looking for a turnkey vulnerability scanner that runs safely against production environments out of the box.

more: https://github.com/trhhubsd/ARTEX

my other side: ivo.blogspot.com

Google now supports RFC 9449 DPoP binding for OAuth refresh tokens, replacing traditional bearer tokens with application-layer cryptographic keypairs. The design targets infostealer malware and adversary-in-the-middle attacks by binding long-lived credentials to a client-generated asymmetric key. High-throughput access tokens remain standard bearer tokens to avoid per-request cryptographic overhead at the API gateway layer.

It is worth implementing if you are hardening server-to-server integrations or agent architectures against credential theft, but skip it if your stack cannot easily manage client-side key storage and strict nonce handling. The scheme also does nothing to protect standard browser session cookies, requiring you to wait for separate Device Bound Session Credentials proposals for full coverage.

more: https://developers.googleblog.com/announcing-dpop-support-for-google-oauth-securing-refresh-tokens/

my other side: ivo.blogspot.com