The index of everything EyalSec publishes in the open, live at eyalsec.github.io: the deliberately vulnerable demo apps, the open-source tools that read your EyalSec events, the live status page, and the guides.
EyalSec follows untrusted data through your running program and reports when it reaches a SQL query, a shell command, a deserializer or a file path. If you are looking for the product itself, start at eyalsec.com or book a live demo.
One static page and nothing to build:
| Path | What it is |
|---|---|
index.html |
The page, with its CSS inline so it renders in one request |
assets/site.js |
Optional extras: the live status board, read from EyalSec/status, and any public repository added since the page was last edited, read from the GitHub API. Without it the page is complete. |
assets/fonts/ |
Space Grotesk and IBM Plex, served from this site so the page makes no third-party requests for them |
404.html |
The not-found page for this domain |
eyalsec.github.io/status/ and eyalsec.github.io/vulnerable-javascript/ are
published from their own repositories; this one only links to them.
python3 -m http.server 8000 --bind 127.0.0.1
# then open http://127.0.0.1:8000Add an <li class="item"> to the matching section of index.html and a
ListItem to the JSON-LD at the top. Until you do, a new public repository
still appears under "Newer repositories", straight from GitHub.
support@eyalsec.com. A vulnerability in EyalSec goes to security@eyalsec.com, under our disclosure policy.
MIT for the page and its code; see LICENSE. The fonts in
assets/fonts/ are under the SIL Open Font License 1.1.