SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Obtain GraphQL API schema despite disabled introspection!
Nikto web server scanner
Advanced vulnerability scanning with Nmap NSE
Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application
dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.
graphw00f is Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.
GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations
Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.
Mining parameters from dark corners of Web Archives
Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.
Brute-Forcing from Nmap output - Automatically attempts default creds on found services.
A Docker image that uses dnmasscan to resolve a file containing domains and scan them with masscan
A python reverse shell that uses DNS as the c2 channel