cxosmo

ssrf-payload-generator

wafw00f

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

CrackQL

CrackQL is a GraphQL password brute-force and fuzzing utility.

EnterprisePurpleTeaming

Purple Team Resources for Enterprise Purple Teaming: An Exploratory Qualitative Study by Xena Olsen.

PurpleSharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

owasp-asvs-checklist

OWASP ASVS checklist for audits

altip

Convert an IP into Alternative / Obfuscated versions of itself

CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files

testssl.sh

Testing TLS/SSL encryption anywhere on any port

rlwrap

A readline wrapper

Ghostwriter

The SpecterOps project management and reporting engine

SSRF-Testing

SSRF (Server Side Request Forgery) testing resources

Search-That-Hash

🔎Searches Hash APIs to crack your hash quickly🔎 If hash is not found, automatically pipes into HashCat⚡

SSTImap

Automatic SSTI detection tool with interactive interface

oauth-scan

Burp Suite Extension useful to verify OAUTHv2 and OpenID security

jwt-secrets

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

sslip.io

Golang-based DNS server which maps DNS records with embedded IP addresses to those addresses.

CrackMapExec

A swiss army knife for pentesting networks

clairvoyance

Obtain GraphQL API schema even if the introspection is disabled

fuzzuli

fuzzuli is a url fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.

codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

smuggler

Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3

original-publication

svg-cheatsheet

A cheatsheet for exploiting server-side SVG processors.

CeWL

CeWL is a Custom Word List Generator

homoglyph

A big list of homoglyphs and some code to detect them

redirect-fuzzer

Fuzzing script for redirect URL validator

code-server

VS Code in the browser