dybhat

ysoserial.net

Deserialization payload generator for a variety of .NET formatters

evilarc

Create tar/zip archives that can exploit directory traversal vulnerabilities

ivr-pentest

books

hacking-books

pentest-tools

A collection of custom security tools for quick needs.

pypykatz

Mimikatz implementation in pure Python

ffuf

Fast web fuzzer written in Go

subdomain3

A new generation of tool for discovering subdomains( ip , cdn and so on)

ccat

Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.

onetwopunch

Use unicornscan to quickly scan all open ports, and then pass the open ports to nmap for detailed scans.

ridenum

Rid_enum is a null session RID cycle attack for brute forcing domain controllers.

BruteX

Automatically brute force all services running on a target.

gitGraber

gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

revshellgen

Reverse shell generator written in Python 3.

cracke-dit

cracke-dit ("Cracked It") makes it easier to perform regular password audits against Active Directory environments.

shhgit

Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.

windows-kernel-exploits

windows-kernel-exploits Windows平台提权漏洞集合

radare2

UNIX-like reverse engineering framework and command-line toolset

liveoverflow_youtube

Material for the YouTube series

PowerShell-AD-Recon

PowerShell Scripts I find useful

Cheatsheet-God

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

hackazon

A modern vulnerable web app

fuzzapi

Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem

dvws

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

DVWS

OWSAP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication.

awesome-jenkins-rce-2019

There is no pre-auth RCE in Jenkins since May 2017, but this is the one!

teh_s3_bucketeers

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

waybackurls

Fetch all the URLs that the Wayback Machine knows about for a domain