Awesome Web Security

GitHub Sensitive Information Leakage（GitHub敏感信息泄露监控）

HTTPLeaks - All possible ways, a website can leak HTTP requests

Reconnaissance Swiss Army Knife

Tool to scan for secret files on HTTP servers

Reverse Shell as a Service

Find web directories without bruteforce

The most complete open-source tool for Twitter intelligence analysis

The Offensive Manual Web Application Penetration Testing Framework.

Analyze the security of any domain by finding all the information possible. Made in python.

Checklist of security precautions for Ruby on Rails applications.

Rip web accessible (distributed) version control systems: SVN/GIT/HG...

DOM fuzzer

Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

Interactive CTF Exploration Tool

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

This project has been moved to:

A DNS rebinding attack framework.

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

Some public notes

A collection of AWS penetration testing junk

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Scriptable local traffic workbench for inspecting, intercepting, replaying, and rewriting HTTP/HTTPS and WebSocket traffic.

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

SpiderSuite (web security crawler) releases, wiki and roadmap

Auditing for TLS certificates.

The AI Agent for Cyber Security.

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin.

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

🔪Browser logic vulnerabilities :skull_and_crossbones:

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

List DTDs and generate XXE payloads using those local DTDs.

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

🔐 Tutorial of setting up Security for your API with one way authentication with TLS/SSL and mutual authentication for a java based web server and a client with both Spring Boot. Different clients are provided such as Apache HttpClient, OkHttp, Spring RestTemplate, Spring WebFlux WebClient Jetty and Netty, the old and the new JDK HttpClient, the old and the new Jersey Client, Google HttpClient, Unirest, Retrofit, Feign, Methanol, vertx, Scala client Finagle, Featherbed, Dispatch Reboot, AsyncHttpClient, Sttp, Akka, Requests Scala, Http4s Blaze, Kotlin client Fuel, http4k, Kohttp and ktor. Also other server examples are available such as jersey with grizzly. Also gRPC, WebSocket and ElasticSearch examples are included

Auto Scanning to SSL Vulnerability

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Content released at NorthSec 2018 for my talk on prototype pollution

JShell - Get a JavaScript shell with XSS.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

Nano is a family of PHP web shells which are code golfed for stealth.

:hammer: Manage your website via terminal

Pillage web accessible GIT, HG and BZR repositories

Stealing CSRF tokens with CSS injection (without iFrames)

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

A free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.

:hammer: A multiple reverse shell session/client manager via terminal

Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.

WebAppSec Content Security Policy

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.