# Jason Haddix repository inventory

Inventory inspected **2026-10-23**, from GitHub repository search `user:jhaddix fork:true`, first page with capacity 100: **78 public results, 67 forks and 11 non-forks**. Repository API metadata was inspected for all 78. A non-fork is not proof of sole authorship. Upstream is the API parent at inspection, not a claim that the fork is synchronized.

This is a triage of the returned public set, not a full code audit. Twelve repositories received the selected-file inspection described in [sources](https://mathborgess.github.io/ai-security-wiki/skills/map-attack-surface/references/sources.md). Other rows are metadata-only unless the limitation says otherwise. Push dates are repository metadata, not the date a method was validated. Selection is an editorial judgment for defensive web/agent studies, not a security rating.

[Recommended reading and tools](https://mathborgess.github.io/ai-security-wiki/wiki/research/jason-haddix.md)

| Repository | Origin / parent | Last push | Study decision | Reason / limit |
|---|---|---|---|---|
| [amass](https://github.com/jhaddix/amass) | Fork of [claritysec/amass](https://github.com/claritysec/amass) | 2019-03-10 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [Amass-1](https://github.com/jhaddix/Amass-1) | Fork of [owasp-amass/amass](https://github.com/owasp-amass/amass) | 2020-08-24 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [asnrecon](https://github.com/jhaddix/asnrecon) | Fork of [orlyjamie/asnrecon](https://github.com/orlyjamie/asnrecon) | 2020-06-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| [awsScrape](https://github.com/jhaddix/awsScrape) | Non-fork | 2024-01-10 | Source-review exercise | Active certificate discovery versus attribution; broad ranges need separate scope |
| [brutesubs](https://github.com/jhaddix/brutesubs) | Fork of [anshumanbh/brutesubs](https://github.com/anshumanbh/brutesubs) | 2017-06-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| [bug-bounty-reference](https://github.com/jhaddix/bug-bounty-reference) | Fork of [ngalongc/bug-bounty-reference](https://github.com/ngalongc/bug-bounty-reference) | 2017-07-21 | Case reading | ngalongc's index; verify each selected primary author/report |
| [bugcrowd-levelup-subdomain-enumeration](https://github.com/jhaddix/bugcrowd-levelup-subdomain-enumeration) | Fork of [appsecco/bugcrowd-levelup-subdomain-enumeration](https://github.com/appsecco/bugcrowd-levelup-subdomain-enumeration) | 2017-07-15 | Reference queue | Metadata only; inspect upstream content before reuse |
| [Caduceus](https://github.com/jhaddix/Caduceus) | Fork of [g0ldencybersec/Caduceus](https://github.com/g0ldencybersec/Caduceus) | 2024-10-07 | Reference queue | Metadata only; inspect upstream content before reuse |
| [can-i-take-over-xyz](https://github.com/jhaddix/can-i-take-over-xyz) | Fork of [EdOverflow/can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz) | 2018-06-30 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [check_mdi](https://github.com/jhaddix/check_mdi) | Fork of [expl0itabl3/check_mdi](https://github.com/expl0itabl3/check_mdi) | 2023-12-21 | Reference queue | Metadata only; inspect upstream content before reuse |
| [choo](https://github.com/jhaddix/choo) | Fork of [choojs/choo](https://github.com/choojs/choo) | 2018-03-16 | Defer | Frontend framework, outside this study |
| [CloudBrute](https://github.com/jhaddix/CloudBrute) | Fork of [0xsha/CloudBrute](https://github.com/0xsha/CloudBrute) | 2020-09-12 | Reference queue | Metadata only; inspect upstream content before reuse |
| [CloudRecon](https://github.com/jhaddix/CloudRecon) | Non-fork | 2023-03-20 | Unresolved | No branches returned; functionality unavailable |
| [CSPReconGO](https://github.com/jhaddix/CSPReconGO) | Non-fork | 2024-07-17 | Source-review exercise | Dependency clues and advertised-versus-implemented behavior |
| [CTFSolutionTypes](https://github.com/jhaddix/CTFSolutionTypes) | Fork of [danielmiessler/CTFSolutionTypes](https://github.com/danielmiessler/CTFSolutionTypes) | 2016-02-05 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [database](https://github.com/jhaddix/database) | Fork of [Euphratee/database](https://github.com/Euphratee/database) | 2024-08-14 | Unresolved | Description absent; content not inspected |
| [deepdarkCTI](https://github.com/jhaddix/deepdarkCTI) | Fork of [fastfire/deepdarkCTI](https://github.com/fastfire/deepdarkCTI) | 2025-03-11 | Defer | Threat-intelligence collection outside the bounded agent-mapping activity |
| [devops-attack-surface](https://github.com/jhaddix/devops-attack-surface) | Non-fork | 2025-10-08 | Study next | Supporting DevOps systems and service identities; verify entries independently |
| [disclose](https://github.com/jhaddix/disclose) | Fork of [disclose/diodb](https://github.com/disclose/diodb) | 2019-01-18 | Reference queue | Metadata only; inspect upstream content before reuse |
| [disclosure-policy](https://github.com/jhaddix/disclosure-policy) | Fork of [bugcrowd/disclosure-policy](https://github.com/bugcrowd/disclosure-policy) | 2018-04-04 | Reference only | Program-scope vocabulary; not legal approval |
| [domain](https://github.com/jhaddix/domain) | Non-fork | 2020-11-17 | Reference queue | Metadata only; inspect upstream content before reuse |
| [dumpdecrypted](https://github.com/jhaddix/dumpdecrypted) | Fork of [stefanesser/dumpdecrypted](https://github.com/stefanesser/dumpdecrypted) | 2012-04-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| [DVIA](https://github.com/jhaddix/DVIA) | Fork of [prateek147/DVIA](https://github.com/prateek147/DVIA) | 2014-02-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| [gnmapper](https://github.com/jhaddix/gnmapper) | Fork of [pect0ral/gnmapper](https://github.com/pect0ral/gnmapper) | 2015-02-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [GraphRunner](https://github.com/jhaddix/GraphRunner) | Fork of [dafthack/GraphRunner](https://github.com/dafthack/GraphRunner) | 2023-11-01 | Defer | Post-exploitation activity outside this mapping skill |
| [gungnir](https://github.com/jhaddix/gungnir) | Fork of [g0ldencybersec/gungnir](https://github.com/g0ldencybersec/gungnir) | 2024-03-15 | Reference queue | Metadata only; inspect upstream content before reuse |
| [hackerone_wordlist](https://github.com/jhaddix/hackerone_wordlist) | Fork of [elamaran619/hackerone_wordlist](https://github.com/elamaran619/hackerone_wordlist) | 2020-06-28 | Reference queue | Metadata only; inspect upstream content before reuse |
| [HUNT](https://github.com/jhaddix/HUNT) | Fork of [bugcrowd/HUNT](https://github.com/bugcrowd/HUNT) | 2019-05-26 | Distill now | Parameter leads and explicit test coverage |
| [InputScanner](https://github.com/jhaddix/InputScanner) | Fork of [zseano/InputScanner](https://github.com/zseano/InputScanner) | 2017-07-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [Internal-Monologue](https://github.com/jhaddix/Internal-Monologue) | Fork of [eladshamir/Internal-Monologue](https://github.com/eladshamir/Internal-Monologue) | 2018-03-19 | Defer | Credential attack activity outside this mapping skill |
| [ios_sh](https://github.com/jhaddix/ios_sh) | Non-fork | 2017-05-04 | Reference queue | Metadata only; inspect upstream content before reuse |
| [jhaddix](https://github.com/jhaddix/jhaddix) | Non-fork | 2023-12-10 | Defer | Profile repository; not methodological evidence |
| [JS-Scan](https://github.com/jhaddix/JS-Scan) | Fork of [zseano/JS-Scan](https://github.com/zseano/JS-Scan) | 2017-07-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [JSParser](https://github.com/jhaddix/JSParser) | Fork of [nahamsec/JSParser](https://github.com/nahamsec/JSParser) | 2017-07-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| [karma_v2](https://github.com/jhaddix/karma_v2) | Fork of [Dheerajmadhukar/karma_v2](https://github.com/Dheerajmadhukar/karma_v2) | 2024-05-03 | Reference queue | Metadata only; inspect upstream content before reuse |
| [KingOfBugBountyTips](https://github.com/jhaddix/KingOfBugBountyTips) | Fork of [KingOfBugbounty/KingOfBugBountyTips](https://github.com/KingOfBugbounty/KingOfBugBountyTips) | 2024-08-01 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [LazyFuzzer](https://github.com/jhaddix/LazyFuzzer) | Fork of [JacobReynolds/LazyFuzzer](https://github.com/JacobReynolds/LazyFuzzer) | 2017-06-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [lazyrecon](https://github.com/jhaddix/lazyrecon) | Fork of [nahamsec/lazyrecon](https://github.com/nahamsec/lazyrecon) | 2018-03-13 | Reference queue | Metadata only; inspect upstream content before reuse |
| [Leaked](https://github.com/jhaddix/Leaked) | Fork of [indomies/Leaked](https://github.com/indomies/Leaked) | 2024-07-11 | Defer | Provenance and rights unresolved; no corpus inspection |
| [LinkFinder](https://github.com/jhaddix/LinkFinder) | Fork of [GerbenJavado/LinkFinder](https://github.com/GerbenJavado/LinkFinder) | 2019-09-05 | Selective lab later | Read supplied JavaScript to reason about hidden endpoints |
| [massdns](https://github.com/jhaddix/massdns) | Fork of [blechschmidt/massdns](https://github.com/blechschmidt/massdns) | 2017-06-23 | Reference queue | Metadata only; inspect upstream content before reuse |
| [meetup](https://github.com/jhaddix/meetup) | Fork of [ngcolombia/medellin](https://github.com/ngcolombia/medellin) | 2018-07-29 | Defer | Angular community repository, outside this study |
| [megplus](https://github.com/jhaddix/megplus) | Fork of [EdOverflow/megplus](https://github.com/EdOverflow/megplus) | 2018-07-01 | Reference queue | Metadata only; inspect upstream content before reuse |
| [msfwiki](https://github.com/jhaddix/msfwiki) | Fork of [pwnwiki/msfwiki](https://github.com/pwnwiki/msfwiki) | 2014-05-28 | Reference queue | Metadata only; inspect upstream content before reuse |
| [mywebappscripts](https://github.com/jhaddix/mywebappscripts) | Fork of [arvinddoraiswamy/mywebappscripts](https://github.com/arvinddoraiswamy/mywebappscripts) | 2016-02-29 | Reference queue | Metadata only; inspect upstream content before reuse |
| [NodeGoat](https://github.com/jhaddix/NodeGoat) | Fork of [OWASP/NodeGoat](https://github.com/OWASP/NodeGoat) | 2016-02-02 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [nomore403](https://github.com/jhaddix/nomore403) | Fork of [devploit/nomore403](https://github.com/devploit/nomore403) | 2024-12-30 | Reference queue | Metadata only; inspect upstream content before reuse |
| [nowafpls](https://github.com/jhaddix/nowafpls) | Fork of [assetnote/nowafpls](https://github.com/assetnote/nowafpls) | 2024-05-14 | Reference queue | Metadata only; inspect upstream content before reuse |
| [nuclei-templates](https://github.com/jhaddix/nuclei-templates) | Fork of [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) | 2020-08-03 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [OWASP-VWAD](https://github.com/jhaddix/OWASP-VWAD) | Fork of [OWASP/OWASP-VWAD](https://github.com/OWASP/OWASP-VWAD) | 2018-03-17 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [P4RS3LT0NGV3](https://github.com/jhaddix/P4RS3LT0NGV3) | Fork of [elder-plinius/P4RS3LT0NGV3](https://github.com/elder-plinius/P4RS3LT0NGV3) | 2026-06-25 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [parseltongue](https://github.com/jhaddix/parseltongue) | Fork of [BASI-LABS/parseltongue](https://github.com/BASI-LABS/parseltongue) | 2025-01-11 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [pentest-bookmarks](https://github.com/jhaddix/pentest-bookmarks) | Non-fork | 2023-12-30 | Reference only | Navigation aid; linked content not reviewed |
| [ptcoresec-scoreboard-ctf](https://github.com/jhaddix/ptcoresec-scoreboard-ctf) | Fork of [balgan/ptcoresec-scoreboard-ctf](https://github.com/balgan/ptcoresec-scoreboard-ctf) | 2012-07-17 | Reference queue | Metadata only; inspect upstream content before reuse |
| [pwnwiki.github.io](https://github.com/jhaddix/pwnwiki.github.io) | Fork of [pwnwiki/pwnwiki.github.io](https://github.com/pwnwiki/pwnwiki.github.io) | 2014-05-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [research](https://github.com/jhaddix/research) | Fork of [bl4de/research](https://github.com/bl4de/research) | 2017-10-04 | Case reading | bl4de's hidden-directory walkthrough, not Jason's incident report |
| [RustScan](https://github.com/jhaddix/RustScan) | Fork of [bee-san/RustScan](https://github.com/bee-san/RustScan) | 2024-11-05 | Reference queue | Metadata only; inspect upstream content before reuse |
| [samuraiwtf](https://github.com/jhaddix/samuraiwtf) | Fork of [SamuraiWTF/samuraiwtf](https://github.com/SamuraiWTF/samuraiwtf) | 2017-07-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| [ScanCannon](https://github.com/jhaddix/ScanCannon) | Fork of [johnnyxmas/ScanCannon](https://github.com/johnnyxmas/ScanCannon) | 2017-08-16 | Reference queue | Metadata only; inspect upstream content before reuse |
| [scripts](https://github.com/jhaddix/scripts) | Non-fork | 2017-10-30 | Reference queue | Metadata only; inspect upstream content before reuse |
| [SecLists](https://github.com/jhaddix/SecLists) | Fork of [danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) | 2018-03-20 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [securedorg.github.io](https://github.com/jhaddix/securedorg.github.io) | Fork of [zigzig122468/securedorg.github.io](https://github.com/zigzig122468/securedorg.github.io) | 2017-04-02 | Reference queue | Metadata only; inspect upstream content before reuse |
| [security-template](https://github.com/jhaddix/security-template) | Fork of [EdOverflow/security-template](https://github.com/EdOverflow/security-template) | 2018-06-29 | Reference queue | Metadata only; inspect upstream content before reuse |
| [SecurityTools](https://github.com/jhaddix/SecurityTools) | Fork of [danielmiessler/SecurityTools](https://github.com/danielmiessler/SecurityTools) | 2016-04-20 | Reference queue | Metadata only; inspect upstream content before reuse |
| [Smap](https://github.com/jhaddix/Smap) | Fork of [s0md3v/Smap](https://github.com/s0md3v/Smap) | 2024-04-03 | Reference queue | Metadata only; inspect upstream content before reuse |
| [spikee](https://github.com/jhaddix/spikee) | Fork of [ReversecLabs/spikee](https://github.com/ReversecLabs/spikee) | 2025-01-27 | Study next | LLM/application/guardrail evaluation design; follow upstream |
| [ssl-conservatory](https://github.com/jhaddix/ssl-conservatory) | Fork of [iSECPartners/ssl-conservatory](https://github.com/iSECPartners/ssl-conservatory) | 2014-01-15 | Selective lab later | Inspect maintained upstream and license before choosing a synthetic exercise |
| [sslScrape](https://github.com/jhaddix/sslScrape) | Fork of [cheetz/sslScrape](https://github.com/cheetz/sslScrape) | 2019-01-19 | Reference queue | Metadata only; inspect upstream content before reuse |
| [SubreconGPT](https://github.com/jhaddix/SubreconGPT) | Non-fork | 2023-05-25 | Source-review exercise | Generated candidates versus DNS, ownership and permission |
| [sus_params](https://github.com/jhaddix/sus_params) | Fork of [g0ldencybersec/sus_params](https://github.com/g0ldencybersec/sus_params) | 2023-12-13 | Reference queue | Metadata only; inspect upstream content before reuse |
| [system_prompts_leaks](https://github.com/jhaddix/system_prompts_leaks) | Fork of [asgeirtj/system_prompts_leaks](https://github.com/asgeirtj/system_prompts_leaks) | 2025-06-01 | Defer | No extraction corpus imported; prefer synthetic boundary examples |
| [system-prompts-and-models-of-ai-tools](https://github.com/jhaddix/system-prompts-and-models-of-ai-tools) | Fork of [x1xhlol/system-prompts-and-models-of-ai-tools](https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools) | 2025-05-31 | Defer | Prompt provenance/rights need separate review |
| [tbhm](https://github.com/jhaddix/tbhm) | Non-fork | 2023-08-01 | Distill now | Discovery, mapping, role comparison and report discipline |
| [TTSL](https://github.com/jhaddix/TTSL) | Fork of [dchrastil/TTSL](https://github.com/dchrastil/TTSL) | 2017-03-16 | Defer | People-data collection outside this study |
| [waybackunifier](https://github.com/jhaddix/waybackunifier) | Fork of [mhmdiaa/chronos](https://github.com/mhmdiaa/chronos) | 2017-08-01 | Reference queue | Metadata only; inspect upstream content before reuse |
| [www-project-top-25-parameters](https://github.com/jhaddix/www-project-top-25-parameters) | Fork of [OWASP/www-project-top-25-parameters](https://github.com/OWASP/www-project-top-25-parameters) | 2023-12-08 | Reference queue | Metadata only; inspect upstream content before reuse |
| [XSS.png](https://github.com/jhaddix/XSS.png) | Fork of [LucaBongiorni/XSS.png](https://github.com/LucaBongiorni/XSS.png) | 2016-04-09 | Reference queue | Metadata only; inspect upstream content before reuse |
| [xssHunterExtension](https://github.com/jhaddix/xssHunterExtension) | Fork of [JacobReynolds/xssHunterExtension](https://github.com/JacobReynolds/xssHunterExtension) | 2016-09-07 | Reference queue | Metadata only; inspect upstream content before reuse |

## Recheck before reuse

Re-list the profile and record additions/removals. Inspect the chosen repository's current revision, primary authors, actual files and license; a fork's API metadata is not a current upstream audit. Review network effects, credentials, data sent to providers, runtime compatibility and authorization before proposing an executable lab. Keep incident data and raw assessment evidence private.