All 42 repositories
Offensive tooling
| Repository | What it does | |
|---|---|---|
| 12★ | endpointhunter | Bug-bounty endpoint discovery |
| 12★ | villain | Undetectable payload/shell generator |
| 10★ | CredStalker- | Automated credential hunting |
| 9★ | vulnx | Auto vulnerability finder + shell injector |
| 6★ | Fucker | Web application vulnerability scanner |
| 3★ | WPGhost | WordPress scanner/exploiter |
| 2★ | ALL_IN_ONE | Multi-tool launcher |
| 2★ | EmailSpoofer | SMTP spoofing |
| 1★ | SQLZ | SQL injection toolkit |
| 1★ | HashDog | Hash cracking |
| 1★ | DIONAEA_FTP_SCANNER | Honeypot FTP testing |
| 1★ | God_Scanner | Scanner |
| 0★ | ZimPwn | LFI/RFI scanner |
| 0★ | JWT-MODIFY | JWT payload tampering |
| 0★ | sessionexploit | Cookie/session decoding |
| 0★ | XSStriker | XSS testing |
| 0★ | CVE-2025-55182 | PoC for the RCE/command-injection CVE |
| 0★ | Admin-Finder | Admin panel discovery (Perl) |
| 0★ | ZForce | Social-media brute force |
| 0★ | wifi_hacker | Wi-Fi auditing (Windows) |
Utilities & platform
| Repository | What it does | |
|---|---|---|
| 2★ | MobiToolKit | Android device tooling |
| 2★ | Keylogger | C++ keylogger |
| 2★ | ufonet | DoS tooling |
| 1★ | ZimMux | One-file tmux theme |
| 1★ | ZIMTHEGOAT | HyDE desktop theme |
| 0★ | git-dumper | Fast .git dumper (Go) |
| 0★ | Jarvis_Zim | Text-to-speech assistant |
| 0★ | DigitalSparkUsbController | USB Rubber Ducky scripts |
| 0★ | PageKite | Reverse proxy for exposing local servers |
Write-ups & coursework
| Repository | Topic |
|---|---|
| 0x41haz-writeup | Reverse-engineering walkthrough |
| XXE-INJECTION | XXE walkthrough (BugForge) |
| phantom-fob-tryhackme | TryHackMe room walkthrough |
| justavpnlogin | TryHackMe room walkthrough |
| cybersecurity_course | Beginner security course |
| course_manual | Course material |
Web & misc
| Repository | What it is |
|---|---|
| ZimShell | Portfolio site |
| portfolio | Portfolio site |
| DarkWeb | HTML/CSS/JS demo page |
| CALCULATOR | Python calculator |
| Ransomware | Ransomware simulation |
| DDos_Zim | DoS tooling |
| FB-Hack | Facebook tooling |
Repos with a zero star count are still listed — the count is a popularity signal, not a quality one, and this list is meant to be complete.
Languages are counted by repository, not by bytes. Byte counts are misleading here: one vendored 15 MB JavaScript tool outweighs every line of Python in the account, which would put JavaScript first. Counting repos answers the more useful question — what does this person actually build?
Open to everyone — questions, collaborations, or just talking shop.
Spamming is not Hacking lil bro [He he]
"Every system has a weakness.
You just have to find it."
How this page works. Every figure above is computed from the live GitHub API and committed daily by a scheduled Action — nothing here is hand-typed, so it cannot drift out of date. The assets are generated by the Python in scripts/. They are self-hosted rather than embedded from third-party badge services, which is why they keep working when those services go down.