Maigret's database lists 5,900 sites, but a default run checks 500 and the list updates itself. How to install it, use it and pin what you searched.

subfinder 2.17.0 tested on darknet.org.uk with no API keys: 17 subdomains in 14 seconds, and only one resolved in DNS. What needs keys, and how to install it.

numbat monitors Claude Code, Codex and other AI coding agents and rebuilds their sessions. Tested on a staged session; its blocking is opt-in and narrow.

Two Burp Suite extensions that group responses by content: Response Overview, a BApp with a threshold you set, and Colonel Clustered, which picks its own.

http-terminator is PortSwigger's AI pipeline for discovering HTTP request-smuggling bugs. Which stages run, its dependencies, and its testing limits.

hashID and Name-That-Hash tested against current password formats. Both miss bcrypt's $2b$ prefix; only Name-That-Hash recognises Argon2id.

whitelist-bypass tunnels traffic through commercial video calls, for networks that allow only approved domains. How its two tunnels work, and the claim to verify.

WRAITH combines BeEF-style browser hooks with blind-XSS capture and a credentialed Page Mirror. Tested locally, with its limits examined.

Praetorian's Go security tools consolidate established offensive workflows, with portable binaries, direct pipelines and a partial shared SDK.

AI IR Overlay specifies containment for agents using valid credentials, with a working kill-switch contract and an admitted gap when no SOC is staffed.