myuyu

SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

fabric

fabric is an open-source framework for augmenting humans using AI. It provides a modular framework for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.

osint_stuff_tool_collection

A collection of several hundred online tools for OSINT

awesome-bugbounty-tools

A curated list of various bug bounty tools

bug-bounty-reference

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

bounty-targets-data

This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

massdns

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

medusa

Binary instrumentation framework based on FRIDA

xsshunter-express

An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!

wordlists

Real-world infosec wordlists, updated regularly

bug-bounty-dorks

List of Google Dorks for sites that have responsible disclosure program / bug bounty program

ms-teams-rce

filterbypass

Browser's XSS Filter Bypass Cheat Sheet

postMessage-tracker

A Chrome Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon

cook

A wordlist framework to fullfill your kinks with your wordlists. For security researchers, bug bounty and hackers.

Nuclei-Templates-Collection

Nuclei Templates Collection

cookiemonster

🍪 CookieMonster helps you detect and abuse vulnerable implementations of stateless sessions.

http-garden

Differential testing and fuzzing of HTTP servers and proxies

php_filter_chain_generator

WordList

surf

Escalate your SSRF vulnerabilities on Modern Cloud Environments. `surf` allows you to filter a list of hosts, returning a list of viable SSRF candidates.

leakScraper

LeakScraper is an efficient set of tools to process and visualize huge text files containing credentials. Theses tools are designed to help penetration testers and redteamers doing OSINT by gathering credentials belonging to their target.

cssInjection

Stealing CSRF tokens with CSS injection (without iFrames)

sj

A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

CSPReconGO

RepeaterSearch

This extension adds a search bar to the Repeater tab that can be used to highlight all repeater tabs where the request and/or response matches a query via simple text matching or Regex.

trickest-cli

Execute Trickest workflows right from your terminal

Publications

DOMClobbering

DOM Clobbering Wiki, Browser Testing, and Payload Generation

HackerzHat