shelld3v

JSshell

JSshell - JavaScript reverse/remote shell

aquatone

A Tool for Domain Flyovers

PwnVPN

The best exploitation tool for SSL VPN 0day vulnerabilities.

RCE-python-oneliner-payload

Python bind shell single line code for both Unix and Windows, used to find and exploit RCE (ImageMagick, Ghostscript, ...)

flydns

Related subdomains finder

fresh-public-dns-servers

A huge, fresh and validated list of DNS servers

CVESearch

Query various sources for CVE proof-of-concepts

dirsearch

Web path scanner

ivre

Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!

Kraken

Shell script to use reconnaissance tools

reflector

Burp plugin able to find reflected XSS on page in real-time while browsing on site

SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

tplmap

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

uro

declutters url lists for crawling/pentesting

Amass

In-depth Attack Surface Mapping and Asset Discovery

Anubis

🔓 Subdomain enumeration and information gathering tool

Anubis-DB

Database to store previously found subdomains

chromedp

A faster, simpler way to drive browsers supporting the Chrome DevTools Protocol.

commix

Automated All-in-One OS command injection and exploitation tool.

dnscan

fiveserver

Open-Source network server for PES5 and PES6 families of the game

gamecure

Gamecure, open source

gobuster

Directory/File, DNS and VHost busting tool written in Go

knock

Knock Subdomain Scan

nuclei-templates

Community curated list of templates for the nuclei engine to find a security vulnerability in application.

SonarSearch

A MongoDB importer and API for Project Sonars DNS datasets

sqlmap

Automatic SQL injection and database takeover tool

subbrute

A DNS meta-query spider that enumerates DNS records, and subdomains.

webBE

xss-reflector

XSS reflector vulnerabilities exploitation extended.