bbakbbak2

bug-bounty-reference

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

awesome-web-security

🐶 A curated list of Web Security materials and resources.

passionfruit

[WIP] Crappy iOS app analyzer

CRLF-Injection-Payloads

Payloads for CRLF Injection

IntruderPayloads

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

off-by-slash

Burp extension to detect alias traversal via NGINX misconfiguration at scale.

HackerOneDB

The unofficial HackerOne disclosure Timeline

Astra

Automated Security Testing For REST API's

the-book-of-secret-knowledge

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

reCAPTCHA

reCAPTCHA = REcognize CAPTCHA: A Burp Suite Extender that recognize CAPTCHA and use for intruder payload 自动识别图形验证码并用于burp intruder爆破模块的插件

awesome-burp-extensions

A curated list of amazingly awesome Burp Extensions

XSStrike

Most advanced XSS scanner.

CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

droidexplorer

A tool to manage your android device with the simplicity of Windows Explorer.

write-ups-2015

Wiki-like CTF write-ups repository, maintained by the community. 2015

write-ups-2016

Wiki-like CTF write-ups repository, maintained by the community. 2016

DVWS

OWSAP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication.

house

A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

Reversing-Challenges-List

CTF Reversing Challenges List

dnSpy

.NET debugger and assembly editor

bugcrowd_university

Open source education content for the researcher community

HUNT

tplmap

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

fuzzdb

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

AndroidLibrary

Android library to reveal or obfuscate strings and assets at runtime

owasp-mastg

The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).

frida-scripts

A collection of my Frida.re instrumentation scripts to facilitate reverse engineering of mobile apps.

crackify

Protection for iOS apps from cracking

frida-scripts

Frida Scripts