bsysop

Bug-bounty

Ressources for bug bounty hunting

active-forks

Find active github forks of a repo https://git.io/vSnrC

aem-hacker

argumentinjectionhammer

A Burp Extension designed to identify argument injection vulnerabilities.

Awesome-Hacking-Resources

A collection of hacking / penetration testing resources to make you better!

awesome-pentest

A collection of awesome penetration testing resources, tools and other shiny things

CVE-2019-3799

CVE-2019-3799 - Spring Cloud Config Server: Directory Traversal < 2.1.2, 2.0.4, 1.4.6

dnschef

DNSChef - DNS proxy for Penetration Testers and Malware Analysts

DNSGrep

Quickly Search Large DNS Datasets

domdig

DOM XSS scanner for Single Page Applications

fuzz.txt

Potentially dangerous files

fuzzing

Tutorials, examples, discussions, research proposals, and other resources related to fuzzing

hckr1

heroku-reverse-proxy

Simple reverse proxy using nginx on Heroku dynos

Information_Collection_Handbook

Handbook of information collection for penetration testing

LFI-phpinfo-RCE

remote code execution with the help of phpinfo and lfi

LFI2RCE

race condition exploit for default php installs where LFI is present

metadata-one-liners

retrive metadata endpoint data with these one liners.

my-arsenal-of-aws-security-tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

payloads

Git All the Payloads! A collection of web attack payloads.

Red-Team-Infrastructure-Wiki

Wiki to collect Red Team infrastructure hardening resources

SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

shakti

Breakdown of Netflix's Shakti API

Spring-Boot-Actuator-Exploit

Spring Boot Actuator (jolokia) XXE/RCE

tbhm

The Bug Hunters Methodology

websocket-smuggle

Issues with WebSocket reverse proxying allowing to smuggle HTTP requests

werdlists

:keyboard: Wordlists, Dictionaries and Other Data Sets for Writing Software Security Test Cases

wifi-arsenal

WiFi arsenal

wordlists

Infosec Wordlists

WS-Attacker

WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum (https://nds.rub.de/ ) and the Hackmanit GmbH (https://www.hackmanit.de/).