A list of useful payloads and bypass for Web Application Security and Pentest/CTF

This repository is primarily maintained by Omar Santos and includes thousands of resources related to ethical hacking / penetration testing, digital forensics and incident response (DFIR), vulnerability research, exploit development, reverse engineering, and more.

Web path scanner

Infection Monkey - An automated pentest tool

Fully automated offensive security framework for reconnaissance and vulnerability scanning

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

Automated Security Testing For REST API's

A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.

Automated NoSQL database enumeration and web application exploitation tool.

Study Notes For Web Hacking / Web安全学习笔记

Awesome hacking is an awesome collection of hacking tools.

SSH man-in-the-middle tool

Gives you one-liners that aids in penetration testing operations, privilege escalation and more

Penetration Testing Platform

Security Tool to Look For Interesting Files in S3 Buckets

Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.

A default credential scanner.

Automated Penetration Testing Framework

Scripts I use during pentest engagements.

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

All in One Hacking Tool for Linux

Sublert is a security and reconnaissance tool which leverages certificate transparency to automatically monitor new subdomains deployed by specific organizations and issued TLS/SSL certificate.

🆕 The Multi-Tool Web Vulnerability Scanner.

Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support.

Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.

Hacking Toolkit

🔐 Lockdoor Framework : A Penetration Testing framework with Cyber Security Resources

Modern tactical exploitation toolkit.

A distributed nmap / masscan scanning framework complete with an API client for automation workflows