Alternatives
Products that do what StaticFuzz does
Catch fabricated location evidence in 12 milliseconds
- 1CA
Hey! We are presenting CodeTracer - a user-friendly time-traveling debugger designed to support a wide range of programming languages: https://github.com/metacraft-labs/codetracer?tab=readme-ov-f... CodeTracer records the execution of a program into a sharable self-contained trace file. You can load the produced trace files in a GUI environment that allows you to move forward and backward through the execution and to examine the history of all memory locations. They say a picture is worth a thousand words — well, a video is even better! Watch the demo below to see…
2025 · github.com
- 2PA
I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice tools for specific tasks by Tom Hudson [1]. However, I disliked that the existing fuzzers were monoliths where I had no easy way of creating custom behavior or analyses. They commonly do a multitude of things: Create multiple requests using one or more wordlist, sending the request,…
2024 · github.com
- 3
- 4SA
I've frequently found myself using [nvitop](https://github.com/XuehaiPan/nvitop) to diagnose GPU/CPU contention issues. The two best things about it are: - It's easy to install if I can access pip in the container - It makes a compelling screenshot (which helps me communicate with coworkers.) With those two lessons in mind: Here is Sping! Purpose: Help observe and diagnose latency issues at layer 4+ (TCP/HTTP/HTTPS) Two good things about it: - It's easy to install if you have pip. (Available at…
2025 · dseltzer.gitlab.io
- 5UJ
Hello HN! I became frustrated with the unpredictible/poor match quality and opaqueness of "relevance scores" in existing fuzzy and fulltext search libs, so I tried something different and this is the result. The main selling point is the result quality / ordering, with best-in-class memory overhead and excellent performance being bonuses. The API is pretty stable at this point, but looking for feedback before committing to 1.0. TL;DR The test corpus is a 4MB json file with 162k words/phrases, so give it a second for initial download. You can also drag/drop your own…
2022 · github.com
- 6
- 7AT
Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
2025 · github.com
- 8CA
Built this after realizing I was spending ~$1400/week on Claude Code with almost no visibility into what was actually consuming tokens. Tools like ccusage give a cost breakdown per model and per day, but I wanted to understand usage at the task level. CodeBurn reads the JSONL session transcripts that Claude Code stores locally (~/.claude/projects/) and classifies each turn into 13 categories based on tool usage patterns (no LLM calls involved). One surprising result: about 56% of my spend was on conversation turns with no tool usage. Actual coding (edits/writes) was…
Apr 2026 · github.com
- 9TH
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
2024 · github.com
- 10AH
Hi HN, I built Ayder — a single-binary, HTTP-native durable event log written in C. The wedge is simple: curl is the client (no JVM, no ZooKeeper, no thick client libs). There’s a 2-minute demo that starts with an unclean SIGKILL, then restarts and verifies offsets + data are still there. Numbers (3-node Raft, real network, sync-majority writes, 64B payload): ~50K msg/s sustained (wrk2 @ 50K req/s), client P99 ~3.46ms. Crash recovery after SIGKILL is ~40–50s with ~8M offsets. Repo link has the video, benchmarks, and quick start. I’m looking for a few early design partners (any…
Jan 2026 · github.com
- 11
Ask Claude Code where your usage went. Token audit, limit diagnosis and usage forensics — built from the session logs already on your machine, nothing leaves it. - kelviq/tare
10d ago · github.com
- 12BB
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com
- 13IB
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com
- 14AP
2017 · debugproxy.com
- 15TT
We've been trying to evaluate web scraping companies, but when you look at their benchmarks, you can't verify anything, and they mostly exist to prove the company is successful. They put somewhere between 98% and 100% because they pick their own urls, define success their own way, and don't publish the harness. We also saw companies like scrapfly astroturf websites like scrapeway and call them independent. So, we built an open source benchmark that we want to represent the frontier of web data. We're trying to look across all major anti-bot providers and industries, to build a comprehensive…
Jul 2026 · github.com
- 16VT
Hi All, this is Shardul here - I am the co-founder of Videobug. https://bug.video We are super excited to share Videobug with you. Videobug records run time code execution so that developers can watch it line by line as frequently as they want, right in their IDE. It takes away the pain of recreating exact conditions that led to a bug and saves developer time in every bug squash. Parth (my co-founder) and I have worked on multiple production grade applications in startups and enterprises. We used Logrocket, Sentry, and Datadog for logging and found ourselves adding more logs after…
2022
- 17AN
When building workflows that rely on LLMs, we commonly use structured output for programmatic use cases like converting an invoice into rows or meeting transcripts into tickets or even complex PDFs into database entries. The model may return the schema you want, but with hallucinated values like `invoice_date` being off by 2 months or the transcript array ordered wrongly. The JSON is valid, but the values are not. Structured output today is a big part of using LLMs, especially when building deterministic workflows. Current structured output benchmarks (e.g., JSONSchemaBench) only validate…
Apr 2026 · interfaze.ai
- 18TY
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh
- 19AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 20AS
2024 · github.com
- 21TS
Hi HN! We’re Ethan and Danny, the authors of Tangent (https://github.com/telophasehq/tangent), a Rust-based log pipeline where all normalization, enrichment, and detection logic runs as WASM plugins. We kept seeing the same problems in the OCSF (https://ocsf.io) community: 1) Schemas change constantly. Large companies have whole teams dedicated to keeping vendor→OCSF mappings up to date. 2) There’s no shared library of mappings, so everyone recreates the same work. 3) Writing mappers is tedious, repetitive work. 4) Most pipelines use proprietary DSLs that are…
Nov 2025 · github.com
- 22
- 23
Capture the web as verifiable, tamper-evident proof
May 2026 · getproofanchor.com
- 24DD
Apr 2026 · flowtriq.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →