marwan-cpu

netlas-dorks

A list of dorks for the Netlas.io search engine, with which you can find millions of objects in the boundless IoE. Contains queries to search for IoT elements, protocols, communication tools, remote access, and more. Over time, the list will grow.

dorky

A tool to quickly do keyword searches over Gitlab and Github for OSINT & bug bounty recon

Recon

About Recon Tools,Methodology and writeups

swagroutes

swagroutes is a command-line tool that extracts and lists API routes from Swagger files in YAML or JSON format.

Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

unimap

Scan only once by IP address and reduce scan times with Nmap for large amounts of data.

ParameterMiner

Built on a lazy Sunday after seeing this tweet (https://twitter.com/intigriti/status/1272145863868104705?s=20) I present to you, ParameterMiner! Pipe in a list of javascript urls and ParameterMiner pulls all the variable names.

wordlists

burp-to-sqlmap

Performing SQLInjection test on Burp Suite Bulk Requests using SQLMap

cupp

Common User Passwords Profiler (CUPP)

mentalist

Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.

LFISuite

Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner

tweeds

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a Tweets and more while evading most API limitations.

awesome-wordlists

A curated list wordlists for bruteforcing and fuzzing

alterx

Fast and customizable subdomain wordlist generator using DSL

jsleak

jsleak is a tool to find secret , paths or links in the source code during the recon.

ReconAIzer

A Burp Suite extension to add OpenAI (GPT) on Burp and help you with your Bug Bounty recon to discover endpoints, params, URLs, subdomains and more!

chomp-scan

A scripted pipeline of tools to streamline the bug bounty/penetration test reconnaissance phase, so you can focus on chomping bugs.

recon

information gathering

ptswarm-twitter

HandE-Burp-Extension

H&E- Burp Highlighter and Extractor

HaE

HaE - Highlighter and Extractor, Empower ethical hacker for efficient operations.

bypass-403

A simple script just made for self use for bypassing 403

shodan-filters

A list of shodan filters

TheTimeMachine

Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not

JSpector

A simple Burp Suite extension to crawl JavaScript (JS) files in passive mode and display the results directly on the issues

sitedorks

Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.

hfuzz

Wordlist for web fuzzing, made from a variety of reliable sources including: result from my pentests, git.rip, ChatGPT, Lex, nuclei templates, web-scanners, seclist, bo0m, and more.

endext

EndExt is a .go tool for extracting all the possible endpoints from the JS files

google-dorks-bug-bounty

A list of Google Dorks for Bug Bounty, Web Application Security, and Pentesting