icytrues

fimap

fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps.

FDsploit

File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.

LFISuite

Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner

liffy

Local file inclusion exploitation tool

github-search

A collection of tools to perform searches on GitHub.

fav-up

IP lookup by favicon using Shodan

commonspeak2-wordlists

Wordlists that have been compiled using Commonspeak2. This repo is updated every time new wordlists are generated.

ssrf-sheriff

A simple SSRF-testing sheriff written in Go

MyPapers

Repository for hosting my research papers

CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

Syborg

Recursive DNS Subdomain Enumerator with dead-end avoidance system (BETA)

assetnote-poc

(Proof of concept) push notifications for passive DNS data

snuffleupagus

Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!

pwnagotchi

(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.

param-miner

keyhacks

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

xmlrpc-bruteforcer

An XMLRPC brute forcer targeting Wordpress written in Python 3. (DISCONTINUED)

jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

PHP-vulnerability-audit-cheatsheet

This will assist you in the finding of potentially vulnerable PHP code. Each type of grep command is categorized in the type of vulnerabilities you generally find with that function.

domdig

DOM XSS scanner for Single Page Applications

fuxploider

File upload vulnerability scanner and exploitation tool.

altdns

Generates permutations, alterations and mutations of subdomains and then resolves them

Arjun

HTTP parameter discovery suite.

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

pq

Pure Go Postgres driver for database/sql

hacks

A collection of hacks and one-off scripts

meg

Fetch many paths for many hosts - without killing the hosts

XSS-Radar

Platypus

:hammer: A modern multiple reverse shell sessions manager written in go

chashell

Chashell is a Go reverse shell that communicates over DNS. It can be used to bypass firewalls or tightly restricted networks.