mud1t

Popular-Site-Subdomains

A list of subdomains for some of the most popular sites on the internet

virtual-host-discovery

A script to enumerate virtual hosts on a server.

h1-212-ctf-solutions

A collection of the solutions people wrote for the H1-212 Capture The Flag event

ZeroNights-WebVillage-2017

pentest-tools

A collection of custom security tools for quick needs.

awesome-web-storage

:sunglasses: Everything you need to know about Client-side Storage.

xvwa

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

reflector

Burp plugin able to find reflected XSS on page in real-time while browsing on site

xss.swf

a tiny tool for swf hacking, just browse it:)

aquatone

A Tool for Domain Flyovers

Useful_Websites_For_Pentester

This repository is to make life of the pentester easy as it is a collection of the websites that can be used by pentesters for day to day studies and to remain updated.

LocalNetworkScanner

PoC Javascript that scans your local network when you open a webpage

bugbounty-cheatsheet

A list of interesting payloads, tips and tricks for bug bounty hunters.

struts-pwn_CVE-2017-9805

An exploit for Apache Struts CVE-2017-9805

LinkFinder

A python script that finds endpoints in JavaScript files

bfac

BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code.

tools-tbhm

Tools of "The Bug Hunters Methodology V2 by @jhaddix"

tbhm

The Bug Hunters Methodology

AWSBucketDump

Security Tool to Look For Interesting Files in S3 Buckets

lazys3

parameth

This tool can be used to brute discover GET and POST parameters

owasp-mastg

The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).

android_app_security_checklist

Android App Security Checklist

XSS-Radar

bosh-cred-and-port-scan

Scripts to scan BOSH directors for open ports and default credentials.

awesome-threat-intelligence

A curated list of Awesome Threat Intelligence resources

awesome-web-security

🐶 A curated list of Web Security materials and resources.

tplmap

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

wpsploit

WPSploit - Exploiting Wordpress With Metasploit