xsuperbug

uxss-db

🔪Browser logic vulnerabilities :skull_and_crossbones:

ATTACKdatamap

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

awesome-electronjs-hacking

A curated list of awesome resources about Electron.js (in)security

chromium-latest-linux

Scripts to download and run the latest Linux build of Chromium. A substitute for Chrome Canary on Linux.

CredzCheckr

Testing default credentials

exploitation-course

Offensive Software Exploitation Course

HolyTips

Tips and Tutorials on Bug Bounty Hunting and Web App Security.

InsecureProgrammingDB

Insecure programming functions database

malware_training_vol1

Materials for Windows Malware Analysis training (volume 1)

nuclei-templates

Community curated list of templates for the nuclei engine to find a security vulnerability in application.

selenium

A browser automation framework and ecosystem.

Tools-Tips

Vanara

A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.

acikkaynak

açık-kaynak.org | İnisiyatif, Topluluk ve Rehber

Advanced-SQL-Injection-Cheatsheet

A cheat sheet that contains advanced queries for SQL Injection of all types.

Broken-Link-Finder

Broken Link Finder is a Burp Extension to detect broken links for a passive scanning domains and links.

bug-bounty-labs

All the labs in this repository simulate real world bugs I found in the wild

bugbounty

bugbounty-1

Bugbounty Resources

burpdeveltraining

Material for the training "Developing Burp Suite Extensions – From Manual Testing to Security Automation"

BurpParamFlagger

A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI.

client-side-prototype-pollution

Prototype Pollution and useful Script Gadgets

OpenDevin

🐚 OpenDevin: Code Less, Make More

phpvuln

Audit tool to find common vulnerabilities in PHP source code

scary-strings

Anlayze source code for dangerous API calls and create report in csv format.

sim-ba

(Sim)ulate (Ba)zar Loader

telegraf

The plugin-driven server agent for collecting & reporting metrics.

VulnerableCodeSnippets

weblogicScanner

weblogic 漏洞扫描工具。目前包含 CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551

workshoplabs

Labs from our workshop "Demystifying the server-side".