Potentially dangerous files

Automated All-in-One OS Command Injection Exploitation Tool.

A collection oneliner scripts for bug bounty

The most powerful CRLF injection (HTTP Response Splitting) scanner.

A fast, simple, recursive content discovery tool written in Rust. | directories status code checker

A next generation HTTP client for Python. 🦋 HTTPX

LFI-SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs…

🔥 🔥 Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more. 🔥 🔥

Tools to perform basic search on GitHub.

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

Accept URLs on stdin, replace all query string values with a user-supplied value

⬆️ ☠️ 🔥 Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation / used for ratelimit based on IP address bypass

Most advanced XSS scanner.

Awesome XSS stuff

declutters url lists for crawling/pentesting - very good tool to test targets with alot of urls

This is go CLI tool for send fast Multiple get HTTP request.

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

The Last Web Recon Tool You'll Need

A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

good collection of wordlists for fuzzing

WAF bypass checklist Injections

A wrapper around grep, to help you grep for things

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep

A repository that includes all the important wordlists used while bug hunting.

Mining parameters from dark corners of Web Archives

This a adaption of tomnomnom's kxss tool with a different output format - testing and finding XSS

Sub-Domain TakeOver Vulnerability Scanner