numbat monitors Claude Code, Codex and other AI coding agents and rebuilds their sessions. Tested on a staged session; its blocking is opt-in and narrow.

Two Burp Suite extensions that group responses by content: Response Overview, a BApp with a threshold you set, and Colonel Clustered, which picks its own.

http-terminator is PortSwigger's AI pipeline for discovering HTTP request-smuggling bugs. Which stages run, its dependencies, and its testing limits.

hashID and Name-That-Hash tested against current password formats. Both miss bcrypt's $2b$ prefix; only Name-That-Hash recognises Argon2id.

whitelist-bypass tunnels traffic through commercial video calls, for networks that allow only approved domains. How its two tunnels work, and the claim to verify.

WRAITH combines BeEF-style browser hooks with blind-XSS capture and a credentialed Page Mirror. Tested locally, with its limits examined.

Praetorian's Go security tools consolidate established offensive workflows, with portable binaries, direct pipelines and a partial shared SDK.

AI IR Overlay specifies containment for agents using valid credentials, with a working kill-switch contract and an admitted gap when no SOC is staffed.

MSSQLand enables red teams to interact with MS-SQL servers and linked instances in restricted environments without complex T-SQL queries. Assembly-ready tool for lateral movement.

Credential stuffing drove 22% of all breaches in 2025. How combolists, infostealers and ATO tooling are fuelling enterprise account takeover at scale