Awesome Web Security

Lightweight coding agent that runs in your terminal

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Automatic SQL injection and database takeover tool

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Find secrets with Gitleaks 🔑

UNIX-like reverse engineering framework and command-line toolset

The Ruby Programming Language

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Most advanced XSS scanner.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

Incredibly fast crawler designed for OSINT.

Fast subdomains enumeration tool for penetration testers

The Browser Exploitation Framework Project

This is a webshell open source project

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

Web application fuzzer

Reconnaissance tool for GitHub organizations

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

A Tool for Domain Flyovers

Automated Αll-in-One OS command injection exploitation tool.

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

Awesome XSS stuff

A python script that finds endpoints in JavaScript files

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

Decrypted content of eqgrp-auction-file.tar.xz

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

A Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf)

A high performance offensive security tool for reconnaissance and vulnerability scanning

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Tool to find metadata and hidden information in the documents.

A fast sub domain brute tool for pentesters

Weaponized web shell

Potentially dangerous files

Chrome extension and Express server that exploits keylogging abilities of CSS.

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

🔥Open source RASP solution

HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors

Automated Security Testing For REST API's

各种漏洞poc、Exp的收集或编写

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

XRay is a tool for recon, mapping and OSINT gathering from public networks.

A collection of JavaScript engine CVEs with PoCs

XSS'OR - Hack with JavaScript.

Tool for advanced mining for content on Github