TheHulk is a dynamic analysis tool designed to detect and exploit DOM Clobbering vulnerabilities.
☆93Oct 18, 2026Updated 2 weeks ago
Alternatives and similar repositories for TheHulk
Users that are interested in TheHulk are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A collection of client-side libraries with HTML injection vulnerabilities and DOM clobbering gadgets.☆50Aug 31, 2025Updated last year
- CSS injection requires an attacker to load a standalone CSS file to leak HTML tag attributes.☆21Apr 19, 2024Updated 2 years ago
- DOMFortify turns on Trusted Types for a page and quietly takes over the browser's default policy, so that old, vulnerable HTML sinks get …☆24Updated this week
- A fancier postMessage tracker with Chrome Manifest version V3 support and a few additional features, inspired by Frans Rosens postmessage…☆133Sep 12, 2025Updated last year
- Chrome extension for automating CSPT discovery☆165Oct 26, 2026Updated last week
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- jxscout superpowers JavaScript analysis for security researchers☆468Apr 12, 2026Updated 6 months ago
- TheThing: an open-source tool to detect DOM Clobbering vulnerabilities☆57Oct 25, 2023Updated 3 years ago
- DOM Clobbering Wiki, Browser Testing, and Payload Generation☆61Dec 18, 2025Updated 10 months ago
- MapperPlus facilitates the extraction of source code from a collection of targets that have publicly exposed .js.map files.☆298Oct 5, 2024Updated 2 years ago
- A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.☆828Dec 9, 2025Updated 10 months ago
- Find XS-Leaks in the browser by diffing DOM-Graphs in two states☆20Jun 24, 2026Updated 4 months ago
- Archive Alchemist is a tool for creating specially crafted archives to test extraction vulnerabilities.☆243Jul 24, 2025Updated last year
- Your AI javascript collaborator☆42May 16, 2025Updated last year
- Unsecure time-based secret exploitation and Sandwich attack implementation Resources☆153Dec 9, 2024Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Useful configurations for the DomLogger++ extension☆52Apr 7, 2026Updated 6 months ago
- Adobe Experience Manager (AEM) hacking toolkit☆118Sep 26, 2025Updated last year
- CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.☆171Jul 2, 2024Updated 2 years ago
- Content-Type Research☆673Jun 29, 2025Updated last year
- API Security Researcher☆17Updated this week
- ☆51Aug 2, 2025Updated last year
- Differential testing framework for HTTP implementations☆949May 28, 2026Updated 5 months ago
- Code for our 2023 IEEE S&P Paper "The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web"☆17Jul 16, 2026Updated 3 months ago
- XS-Leak Browser Test Suite☆88Oct 25, 2026Updated last week
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- This repository is a collection of JavaScript gadgets that can be used to bypass XSS mitigations such as Content Security Policy (CSP) an…☆154Feb 4, 2026Updated 9 months ago
- A command line Curses based json viewer and tabulator☆30Aug 3, 2025Updated last year
- Automated JavaScript Debugging Tool using CDP - Automatically sets breakpoints for specified strings/patterns in JavaScript code☆94Dec 22, 2024Updated last year
- Tool to parse subdomains from dmarc.live☆155Apr 19, 2024Updated 2 years ago
- Extension to log postMessage()☆18Feb 17, 2026Updated 8 months ago
- Abuse trust-boundaries to bypass firewalls and network controls☆434Jul 10, 2026Updated 3 months ago
- Caido plugin for jxscout☆17Jul 7, 2026Updated 3 months ago
- Subbdom API Client☆12Feb 7, 2025Updated last year
- Easily gather all routes related to a NextJs application through parsing of _buildManifest.js☆67Dec 12, 2022Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- An experimental high-performance DNS query bruteforce tool built with AF_XDP for extremely fast and accurate bulk DNS lookups.☆261Oct 9, 2026Updated 3 weeks ago
- Universal Prototype Pollution Gadgets in JavaScript Runtimes☆10Oct 18, 2024Updated 2 years ago
- A collection of Server-Side Prototype Pollution gadgets and exploits☆242Feb 6, 2025Updated last year
- REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications☆1,385Aug 7, 2025Updated last year
- A Chrome/Firefox browser extension to show alerts for reflected query params, show Wayback archive links for the current path, show hidde…☆452Apr 24, 2026Updated 6 months ago
- A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozi…☆183Oct 27, 2026Updated last week
- Finds graphql queries in javascript files☆69May 18, 2024Updated 2 years ago