th3-alch3m1st

cdn

Compiles a list of major CDN and WAF subnets.

slither

Static Analyzer for Solidity and Vyper

CVE-2021-28482-Exchange-POC

POC from TestANull for CVE-2021-28482 on Exchange Server

chru

gosec

Go security checker

PrototypePollution-Lab

Prototype Pollution Lab

bruteforce-http-auth

Bruteforce HTTP Authentication

GCP-IAM-Privilege-Escalation

A collection of GCP IAM privilege escalation methods documented by the Rhino Security Labs team.

git

Assorted tools for security-related task for git repositories

leaks

Extensive code infrastructure for finding unintended information leaks in files, git repositories and much more.

uddup

Urls de-duplication tool for better recon.

Sudomy

Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting

dooked

DNS and Target HTTP History Local Storage and Search

jsubfinder

jsubfinder searches webpages for javascript & analyzes them for hidden subdomains and secrets (wip).

security-cloud-scout

JSScanner

Js File Scanner

ysoserial-modified

That repository contains my updates to the well know java deserialization exploitation tool ysoserial.

leaky-paths

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

dref

DNS Rebinding Exploitation Framework

vulmap

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

eyeballer.pytorch

JSA

Javascript security analysis (JSA) is a program for javascript analysis during web application security assessment.

Android_Security

This repository is a suplimentary material for Android Training's done by Anant Shrivastava from 2012-2017

resources

Tools, data, and contact lists relevant to The disclose.io Project.

ShodanTools

Collection of scripts & fingerprinting tricks for Shodan.io

TrustTrees

A Tool for DNS Delegation Trust Graphing

headi

Customisable and automated HTTP header injection

KingOfBugBountyTips

Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..

resolvers

List of periodically validated public DNS resolvers

hardcidr

hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime.