karvashy

chunkloader

A chrome/Firefox extension to retrieve and load react javascript chunks all at once for a wide range of javascript techs

repolist

Generate wordlists from Github repositories

dmut

A tool to perform permutations, mutations and alteration of subdomains in golang.

LLM101n

LLM101n: Let's build a Storyteller

wscan

Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.

misconfig-mapper

Misconfig Mapper is a fast tool to help you uncover security misconfigurations on popular third-party services used by your company and/or bug bounty targets!

BucketLoot

BucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.

gmapsapiscanner

JS-Tap

JavaScript payload and supporting software to be used as XSS payload or post exploitation implant to monitor users as they use the targeted application. Also includes a C2 for executing custom JavaScript payloads in clients, and a "mimic" feature that automatically generates custom payloads.

smugglefuzz

A rapid HTTP downgrade smuggling scanner written in Go.

domlogger-configs

Useful configurations for the DomLogger++ extension

domloggerpp

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

fuzzing-templates

Community curated list of nuclei templates for finding "unknown" security vulnerabilities.

objection

📱 objection - runtime mobile exploration

burpsuite-project-file-parser

A Burp Suite Extension for parsing Project Files from the CLI.

guidtool

A tool to inspect and attack version 1 GUIDs

cdn-proxy

Bypass CDN and WAF restrictions using CDN re-fronting.

freebind

IPv6 address rate limiting evasion tool (that also supports IPv4)

cloud-service-enum

cookiemonster

🍪 CookieMonster helps you detect and abuse vulnerable implementations of stateless sessions.

can-i-take-over-dns

"Can I take over DNS?" — a list of DNS providers and how to claim vulnerable domains.

weirdAAL

WeirdAAL (AWS Attack Library)

server-side-prototype-pollution

A collection of Server-Side Prototype Pollution gadgets and exploits

postMessage-tracker

A Chrome Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon

AIAIAI

An Incredibly Annoying, Insufferable Authentication Implementation

sic

A tool to perform Sequential Import Chaining

ResourceOverride

An extension to help you gain full control of any website by redirecting traffic, replacing, editing, or inserting new content.

singularity

A DNS rebinding attack framework.

transformers.js

State-of-the-art Machine Learning for the web. Run 🤗 Transformers directly in your browser, with no need for a server!

cloudfox

Automating situational awareness for cloud penetration tests.