Sign in Subscribe

Tools

Security tools I have worked on or built.

NoSQLi 0.5.1 Released

The next Alpha release for NoSQLi is ready for use! This version brings a few minor bug fixes and performance enhancements to existing scans. The primary new feature is the addition of certain PHP GET parameter injections. This means that nosqli now has all the planned injection type detection completed

Security Bug Hunting with Proxies

When hunting security issues or checking applications for potential privacy violations, the first tool I reach for is a web proxy. I frequently get asked about the tools I screenshot in these posts, and asked about my process, so I decided to share the basic steps I take to test

NoSQLi - A Fast NoSQL Injection Scanner

Last year, I started working on a NoSQL injection framework, because I just didn't find a tool that suited my purposes. Other tools are too hard to automate in my workflow, or missed a lot of the simple test cases I tried. So I developed nosqli [https://github.

Subdomain_recon.py: A SubDomain Reconnaissance Tool

Recently I participated in a hackathon building tools to help the blue team inventory our external attack surface. We are a large business with many global locations, datacenters, and devices, built up over time and via acquisition, so there is a lot to search for, and our internal inventories don&

Launching the Mozilla Plugin Privacy Test Database

Today, I launched the Plugin Privacy Test Database for Mozilla plugins [https://nullsweep.com/mozilla-plugin-privacy-database/]. The tests attempt to determine whether plugins passively gather data about users browsing habits. In this introductory blog post, I will outline the test methods used and some of the results limitations. For a step

Personal Security & Privacy Tools I Recommend

Updated in December 2019 to account for recent changes in the product landscape. In summary, I switched from PIA to Mullvad for VPN, and no longer recommend StartPage for search. Friends and family sometimes ask me for advice about security tools or practices they should use to improve their own