CoolGithubProjects

strypt 0.2.0: the metadata stripper now has a desktop app (Rust + egui, no network code, reproducible builds) https://redd.it/1wqkdj9 @r_CoolGithubProjects

Read-only Reddit tools for AI agents that work now that Reddit redirects signed-out requests to login - ThreadFox Lite (Python, MIT) https://github.com/amflimited/threadfox-lite?utm_source=reddit&utm_campaign=tf-lite-coolgithubprojects https://redd.it/1wqj1w5 @r_CoolGithubProjects

Sley 2.0: an open-source programming system for AI coding agents, with a Rust kernel whose bytes an independent Python oracle reproduces exactly https://github.com/sley-lang/sley https://redd.it/1wqb0so @r_CoolGithubProjects

TiddlyInstall: A universal, reusable install system for your projects What it does: Easily make installers for all your projects directly from a browser. You can even save the whole page as a single file and it keeps working offline. Introduction TiddlyInstall is based on the observation that programs written for runtimes like Python, Nodejs, and others -- all follow the same basic pattern: they need a runtime installed and then the software. Existing approaches like freezing apps or trying to package it as an exe often break. Or require insane struggle by the developers. The simplest possible approach is to install the runtime on a users computer, isolated, with the package inside it. It is more wasteful in terms of disk space -- but can be generalised to build reusable installers that work for just about any language. Reusable installers A reusable installer reads its own meta-data to decide on the runtime to install and the project. Linux and Mac are supported through a bash script while all windows versions use an NSIS program. The unusual thing about this is once you build the reusable installers since it's just meta-data everything can be edited inside the browser. No new compilations are needed. It's a very elegant system. Try it out yourself: https://robertsdotpm.github.io/\_static/tiddlyinstall.html Github: https://github.com/robertsdotpm/tiddlyinstall https://redd.it/1wqg4y4 @r_CoolGithubProjects

I made an offline document editor for people who want notes with built-in math calculations and charts. What do you think? https://redd.it/1wq2k14 @r_CoolGithubProjects

Vulpin – a minimalist scripting language where every statement is a single character command https://github.com/vulpin-lang https://redd.it/1wqe094 @r_CoolGithubProjects

Free tracker for class action lawsuits https://redd.it/1wqck69 @r_CoolGithubProjects

[C++] ceasta - disassembler, decompiler and debugger in one, with a built-in MCP server for driving it from an AI (windows, linux, macos) https://github.com/ngwg/ceasta https://redd.it/1wq9m5f @r_CoolGithubProjects

He literally built iHatePDF because iLovePDF rejected his job application https://redd.it/1wq4z97 @r_CoolGithubProjects

GitHub - nickolasdeluca/pane_ts: A web port of Pane. Compose App Store screenshots in your browser, with 3D iPhone mockups rendered in Three.js https://github.com/nickolasdeluca/pane_ts https://redd.it/1wq7ljp @r_CoolGithubProjects

Ming-Image: public MIT inference code for two 6B design-image models https://redd.it/1wq2tj1 @r_CoolGithubProjects

DEV·TV: a retro TV for the developer internet in one HTML file (featured on Product Hunt today) https://redd.it/1wq269m @r_CoolGithubProjects

Linka a open source and federate social media for android 1.5 https://redd.it/1wq2a3v @r_CoolGithubProjects

cargo-atlas — Compiler-accurate Rust code intelligence for AI coding agents https://github.com/TheBlitzschnell/cargo-atlas https://redd.it/1wpzt6g @r_CoolGithubProjects

I built Peerino – a P2P file sharing app with no cloud, no accounts, and no intermediary https://redd.it/1wpz33z @r_CoolGithubProjects

I built a tool that writes four versions of every post and lets Jev decide which one goes out https://redd.it/1wpy2en @r_CoolGithubProjects

scanner's detection and false-positive vetoes can be verified rather than assumed. A correct scanner reports no findings on all seventeen safe endpoints. Note: the labs are not included in the PyPI package or any other distribution package. They can be installed and run separately from the GitHub repository. Repository: [https://github.com/kamalx06/XXERipper](https://github.com/kamalx06/XXERipper) Installation: pip install xxeripper Feedback on detection accuracy against real-world targets is welcome. https://redd.it/1wpwsp3 @r_CoolGithubProjects

built-in HTTP server (--oob-listen), a directory served by the operator's own web server (--oob-dtd-dir), or the WebUI's Flask routes. Exfiltrated content is routed through the same file-content and credential extractors used for in-band reads, so a blind read of /etc/passwd produces the same loot entry as an in-band read. # Credential extraction Seven credential kinds are recognized and stored with paste-ready shell snippets: * AWS IAM — JSON from IMDS, and INI from the CLI credentials file. Snippets: aws sts get-caller-identity, aws s3 ls, IAM policy enumeration, and an export block for the current shell. * Alibaba RAM — aliyun sts GetCallerIdentity, aliyun oss ls, and an export block with the correct ALIBABA\_CLOUD\_\* variables. * SSH private keys — install, fingerprint, and try against github.com / gitlab.com / bitbucket.org. * GCP service accounts — activate with gcloud auth activate-service-account. * OAuth access tokens — curl against Google's userinfo endpoint (works for GCP tokens) and Azure's subscriptions endpoint. * Kubernetes service-account tokens — JWT payload decoded to namespace and service-account name. * Generic bearer tokens — curl against httpbin.org/bearer to test liveness. # Chain analysis A ChainTracker derives chain stages from finding IDs and evidence. When all stages of a template are present, a rollup finding names the end-to-end impact. Thirteen templates ship with the scanner: XXE -> in-band file read -> credential theft XXE -> IMDS -> IAM credentials -> AWS account takeover XXE -> error-based leak -> file content recovered XXE -> PHP filter -> source disclosure XXE -> protocol wrapper -> RCE chain XXE -> blind OOB callback confirmed XXE -> SSRF -> internal service reached XXE -> WAF bypass -> entity resolution confirmed XXE -> Kubernetes secrets API -> cluster credential theft XXE -> in-cluster SA token read XXE -> SSH private key -> lateral movement primitive XXE -> GCP metadata -> OAuth token extraction XXE -> Azure IMDS -> managed-identity token Rollups appear in JSON, SARIF, and HTML output like any other finding. # WAF bypass Fifteen encoders across three families: * Document encoders: utf16be, utf16le, utf16decl, utf16nobom, utf32be, utf32le, ebcdic, ucs4\_2143, utf8bom * Keyword-evasion encoders: public, public\_charref, b64\_uri * Grammar-level encoders: whitespace\_pad, doctype\_closure, pe\_stager The WAF bypass phase runs after the core phases, not before. A target that responds to a plain SYSTEM "file://" payload does not need to be sent 1,500 encoded variants first — the direct probes find it in roughly 20 requests, and the encoded sweep is the fallback for when they were blocked. Encoders whose output is byte-identical to the input are skipped (no request sent). # Interface and output * CLI with Burp request ingestion, cookie management, pre-auth request replay, rate limiting, wall-clock budget, and cooperative cancellation. * Web console (Flask, single self-contained HTML file, no CDN) with live event streaming, a command palette, keyboard navigation, and per-job download buttons for JSON, SARIF, and HTML. * JSON (schema 1.1), SARIF v2.1.0, and self-contained printable HTML. * CI exit codes for --fail-on thresholds; works with GitHub Actions and GitLab CI. # Reliability * Per-phase exception isolation — a crash in one technique family cannot lose findings from phases already completed. * Rate limiting independent of thread count. * Retry with backoff on transient failures (ConnectError, RemoteProtocolError, ReadError, WriteError, TimeoutException). HTTP 500 is deliberately not retried, because error-based XXE targets return 500 on purpose. * On-disk fingerprint cache so repeat scans skip the probe phase. * Cooperative cancellation; every phase checks the ScanContext before each payload send. # Test labs The repository ships with two local test labs — a Python/Flask lab and a Java/Xerces lab — totalling 54 endpoints split across vulnerable, safe, and false-negative-bait categories. They exist so the

XXERipper: an open-source XXE scanner with differential parser fingerprinting, mandatory-signal gating, and chain-based impact analysis I am releasing XXERipper v1.0.0, an open-source XML External Entity scanner I have been working on for the past five months. # What it does XXERipper is a black-box scanner for XXE. It runs in-band, error-based, and blind out-of-band techniques, fingerprints the target's XML parser, and reports findings with CWE mappings, a confidence score, and where applicable the recovered file content and extracted credentials. The design is driven by a single problem: most XXE scanners treat "the parser accepted my DOCTYPE" as equivalent to "the external entity resolved." Those two outcomes produce similar response deltas and are difficult to distinguish without additional evidence. XXERipper requires a mandatory signal before confirming any finding. # Detection model Every candidate response is scored against a seven-sample statistical baseline (median length, IQR, p95, mode status, most-common body hash, median Shannon entropy, windowed entropy over 256-byte windows). Signals carry the following weights: +50 correlated OOB callback (token match) +40 file-content fingerprint (+5 per additional indicator) +25 chain integrity (entity resolved end-to-end) +20 parser error delta +20 timing anomaly +10 length delta >= 20% +5 status code shift Vetoes: -100 reflection (payload echoed verbatim) -75 normalized baseline match -50 byte-identical baseline body -30 soft reflection (reflection present but a strong signal too) Classification requires a mandatory signal — one of file\_type, oob\_correlated, or chain\_integrity. Parser errors and timing anomalies contribute to score but cannot confirm a finding independently. A response scoring >=70 with only one independent evidence family is capped at HIGH rather than CRITICAL. # Parser fingerprinting Nine paired test/control probes identify the underlying XML stack across eleven signature families (libxml2, Xerces, .NET, Java SAX, Java StAX, python-etree, PHP DOM, Ruby, Node, Perl, Go). A capability is marked present only when the test probe succeeds and the control does not, which makes the result differential rather than pattern-matched. Results are cached per-URL, so repeat scans skip the probe phase. The fingerprint gates two phases (in-band file read, error-based local-DTD sweep) so a target that does not resolve entities is not sent the full payload catalogue. # Attack coverage Many technique families are used, as an example: * In-band file read, PHP filter chain, PHP expect:// RCE * Error-based: local DTD reuse, malformed entity * Blind: DNS OOB, external DTD, parameter-entity OOB, CDATA bypass, timing-based * Encoding bypass: UTF-16, UTF-7, UCS-4, alternate DOCTYPE * Alternative sinks: XInclude (parse=text and parse=xml), SVG upload, SAML envelope, SOAP envelope * Extended fetchers: XSLT document(), XSLT xsl:include, XSD schemaLocation, XSD import, xml-stylesheet PI * Cloud metadata: AWS IMDSv1 and IMDSv2 (detected separately), GCP, Azure, Alibaba, OCI, Kubernetes — 12 endpoints across 6 providers * RCE wrappers: Java jar:, PHP data://, phar://, glob://, compress.zlib:// * Office document: DOCX and XLSX xml-stylesheet PI, fetched by server-side XSLT processors * YAML deserialization: PyYAML and SnakeYAML type tags * SAML pre-signature: assertion parsed before signature verification * JSON-to-XML: content-type switching on JSON-only endpoints Beyond the standard POST with application/xml shape, the scanner probes a Content-Type matrix, HTTP method variation (PUT/PATCH), query-parameter injection, form-encoded bodies, and multipart uploads. # Out-of-band confirmation and blind exfiltration OOB uses interactsh-client in manual mode (scanner prints subdomains, operator watches the client) or auto mode (scanner spawns interactsh-client and correlates callbacks in-process by 16-hex token). For blind exfiltration, the scanner serves the DTD through one of three mechanisms: a