0xJeti

Fuzzing101

An step by step fuzzing tutorial. A GitHub Security Lab initiative

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

mubeng

An incredibly fast proxy checker & IP rotator with ease.

medusa

Binary instrumentation framework based on FRIDA

graudit

grep rough audit - source code auditing tool

Cloud-Security-Attacks

Azure and AWS Attacks

resolvers

The most exhaustive list of reliable DNS resolvers.

fuzzuli

fuzzuli is a url fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.

surf

Escalate your SSRF vulnerabilities on Modern Cloud Environments. `surf` allows you to filter a list of hosts, returning a list of viable SSRF candidates.

haylxon

⚡ Blazing-fast tool to grab screenshots of your domain list right from terminal.

domloggerpp

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

chameleon

graphql-wordlist

The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct GraphQL schemas.

TInjA

TInjA is a CLI tool for testing web pages for template injection vulnerabilities and supports 44 of the most relevant template engines for eight different programming languages.

subdirectories-discover

Perfect wordlist for discovering directories and files on target site

Challenges_2022_Public

Files + Writeups for DownUnderCTF 2022 Challenges

gungnir

CT Log Scanner

padre

Blazing fast, advanced Padding Oracle exploit

Helios

Helios: Automated XSS Testing

sasori

Sasori is a dynamic web crawler powered by Puppeteer, designed for lightning-fast endpoint discovery.

server-side-prototype-pollution

A collection of Server-Side Prototype Pollution gadgets and exploits

VhostFinder

Identify virtual hosts by similarity comparison

wwwordlist

Wwwordlist is a wordlist generator for pentesters and bug bounty hunters. It extracts words from HTML, URLs, JS/HTTP/input variables, quoted texts in the text and mail files in order to generate wordlists.

apkd

APK downloader from few sources

Prototype-Pollution-Gadgets-Finder

chunkloader

A chrome/Firefox extension to retrieve and load react javascript chunks all at once for a wide range of javascript techs

ctf-vs-the-real-world

Informational Repository tracking times that real world bugs have come out of CTF challenges intentionally or otherwise

IISRecon

IIS shortname scanner + bruteforce

protobuf-decoder

A simple Google Protobuf Decoder for Burp

open-asset-model

Asset definitions for an organization's external attack surface