Jason Haddix repository inventory
Inventory inspected 2026-10-23, from GitHub repository search user:jhaddix fork:true, first page with capacity 100: 78 public results, 67 forks and 11 non-forks. Repository API metadata was inspected for all 78. A non-fork is not proof of sole authorship. Upstream is the API parent at inspection, not a claim that the fork is synchronized.
This is a triage of the returned public set, not a full code audit. Twelve repositories received the selected-file inspection described in sources. Other rows are metadata-only unless the limitation says otherwise. Push dates are repository metadata, not the date a method was validated. Selection is an editorial judgment for defensive web/agent studies, not a security rating.
| Repository | Origin / parent | Last push | Study decision | Reason / limit |
|---|---|---|---|---|
| amass | Fork of claritysec/amass | 2019-03-10 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| Amass-1 | Fork of owasp-amass/amass | 2020-08-24 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| asnrecon | Fork of orlyjamie/asnrecon | 2020-06-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| awsScrape | Non-fork | 2024-01-10 | Source-review exercise | Active certificate discovery versus attribution; broad ranges need separate scope |
| brutesubs | Fork of anshumanbh/brutesubs | 2017-06-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| bug-bounty-reference | Fork of ngalongc/bug-bounty-reference | 2017-07-21 | Case reading | ngalongc's index; verify each selected primary author/report |
| bugcrowd-levelup-subdomain-enumeration | Fork of appsecco/bugcrowd-levelup-subdomain-enumeration | 2017-07-15 | Reference queue | Metadata only; inspect upstream content before reuse |
| Caduceus | Fork of g0ldencybersec/Caduceus | 2024-10-07 | Reference queue | Metadata only; inspect upstream content before reuse |
| can-i-take-over-xyz | Fork of EdOverflow/can-i-take-over-xyz | 2018-06-30 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| check_mdi | Fork of expl0itabl3/check_mdi | 2023-12-21 | Reference queue | Metadata only; inspect upstream content before reuse |
| choo | Fork of choojs/choo | 2018-03-16 | Defer | Frontend framework, outside this study |
| CloudBrute | Fork of 0xsha/CloudBrute | 2020-09-12 | Reference queue | Metadata only; inspect upstream content before reuse |
| CloudRecon | Non-fork | 2023-03-20 | Unresolved | No branches returned; functionality unavailable |
| CSPReconGO | Non-fork | 2024-07-17 | Source-review exercise | Dependency clues and advertised-versus-implemented behavior |
| CTFSolutionTypes | Fork of danielmiessler/CTFSolutionTypes | 2016-02-05 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| database | Fork of Euphratee/database | 2024-08-14 | Unresolved | Description absent; content not inspected |
| deepdarkCTI | Fork of fastfire/deepdarkCTI | 2025-03-11 | Defer | Threat-intelligence collection outside the bounded agent-mapping activity |
| devops-attack-surface | Non-fork | 2025-10-08 | Study next | Supporting DevOps systems and service identities; verify entries independently |
| disclose | Fork of disclose/diodb | 2019-01-18 | Reference queue | Metadata only; inspect upstream content before reuse |
| disclosure-policy | Fork of bugcrowd/disclosure-policy | 2018-04-04 | Reference only | Program-scope vocabulary; not legal approval |
| domain | Non-fork | 2020-11-17 | Reference queue | Metadata only; inspect upstream content before reuse |
| dumpdecrypted | Fork of stefanesser/dumpdecrypted | 2012-04-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| DVIA | Fork of prateek147/DVIA | 2014-02-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| gnmapper | Fork of pect0ral/gnmapper | 2015-02-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| GraphRunner | Fork of dafthack/GraphRunner | 2023-11-01 | Defer | Post-exploitation activity outside this mapping skill |
| gungnir | Fork of g0ldencybersec/gungnir | 2024-03-15 | Reference queue | Metadata only; inspect upstream content before reuse |
| hackerone_wordlist | Fork of elamaran619/hackerone_wordlist | 2020-06-28 | Reference queue | Metadata only; inspect upstream content before reuse |
| HUNT | Fork of bugcrowd/HUNT | 2019-05-26 | Distill now | Parameter leads and explicit test coverage |
| InputScanner | Fork of zseano/InputScanner | 2017-07-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| Internal-Monologue | Fork of eladshamir/Internal-Monologue | 2018-03-19 | Defer | Credential attack activity outside this mapping skill |
| ios_sh | Non-fork | 2017-05-04 | Reference queue | Metadata only; inspect upstream content before reuse |
| jhaddix | Non-fork | 2023-12-10 | Defer | Profile repository; not methodological evidence |
| JS-Scan | Fork of zseano/JS-Scan | 2017-07-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| JSParser | Fork of nahamsec/JSParser | 2017-07-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| karma_v2 | Fork of Dheerajmadhukar/karma_v2 | 2024-05-03 | Reference queue | Metadata only; inspect upstream content before reuse |
| KingOfBugBountyTips | Fork of KingOfBugbounty/KingOfBugBountyTips | 2024-08-01 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| LazyFuzzer | Fork of JacobReynolds/LazyFuzzer | 2017-06-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| lazyrecon | Fork of nahamsec/lazyrecon | 2018-03-13 | Reference queue | Metadata only; inspect upstream content before reuse |
| Leaked | Fork of indomies/Leaked | 2024-07-11 | Defer | Provenance and rights unresolved; no corpus inspection |
| LinkFinder | Fork of GerbenJavado/LinkFinder | 2019-09-05 | Selective lab later | Read supplied JavaScript to reason about hidden endpoints |
| massdns | Fork of blechschmidt/massdns | 2017-06-23 | Reference queue | Metadata only; inspect upstream content before reuse |
| meetup | Fork of ngcolombia/medellin | 2018-07-29 | Defer | Angular community repository, outside this study |
| megplus | Fork of EdOverflow/megplus | 2018-07-01 | Reference queue | Metadata only; inspect upstream content before reuse |
| msfwiki | Fork of pwnwiki/msfwiki | 2014-05-28 | Reference queue | Metadata only; inspect upstream content before reuse |
| mywebappscripts | Fork of arvinddoraiswamy/mywebappscripts | 2016-02-29 | Reference queue | Metadata only; inspect upstream content before reuse |
| NodeGoat | Fork of OWASP/NodeGoat | 2016-02-02 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| nomore403 | Fork of devploit/nomore403 | 2024-12-30 | Reference queue | Metadata only; inspect upstream content before reuse |
| nowafpls | Fork of assetnote/nowafpls | 2024-05-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| nuclei-templates | Fork of projectdiscovery/nuclei-templates | 2020-08-03 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| OWASP-VWAD | Fork of OWASP/OWASP-VWAD | 2018-03-17 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| P4RS3LT0NGV3 | Fork of elder-plinius/P4RS3LT0NGV3 | 2026-06-25 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| parseltongue | Fork of BASI-LABS/parseltongue | 2025-01-11 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| pentest-bookmarks | Non-fork | 2023-12-30 | Reference only | Navigation aid; linked content not reviewed |
| ptcoresec-scoreboard-ctf | Fork of balgan/ptcoresec-scoreboard-ctf | 2012-07-17 | Reference queue | Metadata only; inspect upstream content before reuse |
| pwnwiki.github.io | Fork of pwnwiki/pwnwiki.github.io | 2014-05-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| research | Fork of bl4de/research | 2017-10-04 | Case reading | bl4de's hidden-directory walkthrough, not Jason's incident report |
| RustScan | Fork of bee-san/RustScan | 2024-11-05 | Reference queue | Metadata only; inspect upstream content before reuse |
| samuraiwtf | Fork of SamuraiWTF/samuraiwtf | 2017-07-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| ScanCannon | Fork of johnnyxmas/ScanCannon | 2017-08-16 | Reference queue | Metadata only; inspect upstream content before reuse |
| scripts | Non-fork | 2017-10-30 | Reference queue | Metadata only; inspect upstream content before reuse |
| SecLists | Fork of danielmiessler/SecLists | 2018-03-20 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| securedorg.github.io | Fork of zigzig122468/securedorg.github.io | 2017-04-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| security-template | Fork of EdOverflow/security-template | 2018-06-29 | Reference queue | Metadata only; inspect upstream content before reuse |
| SecurityTools | Fork of danielmiessler/SecurityTools | 2016-04-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| Smap | Fork of s0md3v/Smap | 2024-04-03 | Reference queue | Metadata only; inspect upstream content before reuse |
| spikee | Fork of ReversecLabs/spikee | 2025-01-27 | Study next | LLM/application/guardrail evaluation design; follow upstream |
| ssl-conservatory | Fork of iSECPartners/ssl-conservatory | 2014-01-15 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| sslScrape | Fork of cheetz/sslScrape | 2019-01-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| SubreconGPT | Non-fork | 2023-05-25 | Source-review exercise | Generated candidates versus DNS, ownership and permission |
| sus_params | Fork of g0ldencybersec/sus_params | 2023-12-13 | Reference queue | Metadata only; inspect upstream content before reuse |
| system_prompts_leaks | Fork of asgeirtj/system_prompts_leaks | 2025-06-01 | Defer | No extraction corpus imported; prefer synthetic boundary examples |
| system-prompts-and-models-of-ai-tools | Fork of x1xhlol/system-prompts-and-models-of-ai-tools | 2025-05-31 | Defer | Prompt provenance/rights need separate review |
| tbhm | Non-fork | 2023-08-01 | Distill now | Discovery, mapping, role comparison and report discipline |
| TTSL | Fork of dchrastil/TTSL | 2017-03-16 | Defer | People-data collection outside this study |
| waybackunifier | Fork of mhmdiaa/chronos | 2017-08-01 | Reference queue | Metadata only; inspect upstream content before reuse |
| www-project-top-25-parameters | Fork of OWASP/www-project-top-25-parameters | 2023-12-08 | Reference queue | Metadata only; inspect upstream content before reuse |
| XSS.png | Fork of LucaBongiorni/XSS.png | 2016-04-09 | Reference queue | Metadata only; inspect upstream content before reuse |
| xssHunterExtension | Fork of JacobReynolds/xssHunterExtension | 2016-09-07 | Reference queue | Metadata only; inspect upstream content before reuse |
Recheck before reuse
Re-list the profile and record additions/removals. Inspect the chosen repository's current revision, primary authors, actual files and license; a fork's API metadata is not a current upstream audit. Review network effects, credentials, data sent to providers, runtime compatibility and authorization before proposing an executable lab. Keep incident data and raw assessment evidence private.