Awesome Web Security

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Automatic SQL injection and database takeover tool

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Most advanced XSS scanner.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Incredibly fast crawler designed for OSINT.

Fast subdomains enumeration tool for penetration testers

Web application fuzzer

Automated Αll-in-One OS command injection exploitation tool.

A python script that finds endpoints in JavaScript files

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

A Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf)

A high performance offensive security tool for reconnaissance and vulnerability scanning

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

A fast sub domain brute tool for pentesters

Weaponized web shell

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

Automated Security Testing For REST API's

各种漏洞poc、Exp的收集或编写

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

Tool for advanced mining for content on Github

GitHub Sensitive Information Leakage（GitHub敏感信息泄露监控）

Reconnaissance Swiss Army Knife

Tool to scan for secret files on HTTP servers

Find web directories without bruteforce

The most complete open-source tool for Twitter intelligence analysis

The Offensive Manual Web Application Penetration Testing Framework.

Analyze the security of any domain by finding all the information possible. Made in python.

DOM fuzzer

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

A collection of AWS penetration testing junk

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

Auto Scanning to SSL Vulnerability

JShell - Get a JavaScript shell with XSS.

:hammer: Manage your website via terminal

A free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.

:hammer: A multiple reverse shell session/client manager via terminal

Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.

A domain searcher named GoogleSSLdomainFinder - 基于谷歌SSL透明证书的子域名查询工具

Parse NTLM challenge messages over HTTP and SMB

Git manager for pentesters

Vulnerable Web applications Generator

A script that inspects multi-byte character sets looking for characters with specific user-defined properties

Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).