mmirnosir

crowbar

Crowbar is brute forcing tool that can be used during penetration tests. It is developed to support protocols that are not currently supported by thc-hydra and other popular brute forcing tools.

WebHackersWeapons

⚔️ Web Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting

CSPTBurpExtension

CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.

burp-extensions-montoya-api-examples

Examples for using the Montoya API with Burp Suite

burp-extensions-montoya-api

Burp Extensions Api

awesome-osint

:scream: A curated list of amazingly awesome OSINT

enumerate-iam

Enumerate the permissions associated with AWS credential set

ultimate_discovery

Ultimate Wordlist for Web Content Discovery

Arjun

HTTP parameter discovery suite.

keyhacks

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

waymore

Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan & VirusTotal!

gotator

Gotator is a tool to generate DNS wordlists through permutations.

Gf-Patterns

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep

Gxss

A tool to check a bunch of URLs that contain reflecting params.

graphql-json-to-sdl

A command line utility for converting a JSON GraphQL schema to GraphQL SDL

fuzz.txt

Potentially dangerous files

domloggerpp

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

Source2URL

Parse source code directories and output list of URLs that are then sent through a proxy.

python-for-awae

Python for AWAE (Advanced Web Attacks and Exploitation)

JSONBee

A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

graphql-wordlist

The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct GraphQL schemas.

LinkFinder

A python script that finds endpoints in JavaScript files

BBTz

BBT - Bug Bounty Tools (examples💡)

uro

declutters url lists for crawling/pentesting

Bate5a

api_wordlist

A wordlist of API names for web application assessments

jaeles

The Swiss Army knife for automated Web Application Testing

Bug-Bounty-Wordlists

A repository that includes all the important wordlists used while bug hunting.

bounty-targets-data

This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

dhcp-spoof

simulate DHCP spoofing on a virtual network using Mininet