A list of useful payloads and bypass for Web Application Security and Pentest/CTF

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

🕵️‍♂️ Offensive Google framework.

Most advanced XSS scanner.

The Rogue Access Point Framework

fabric is an open-source framework for augmenting humans using AI. It provides a modular framework for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

HTTP parameter discovery suite.

Requests + Gevent = <3

Module for automatic summarization of text documents and HTML pages.

IntelOwl: manage your Threat Intelligence at scale

Automatically create and sync Home Assistant backups into Google Drive

Subtitles, faster than your thoughts

Tool for Active Directory Certificate Services enumeration and abuse

All In One Web Recon

Print awesomely in terminals.

Run PowerShell command without invoking powershell.exe

Self-hosted, local only NVR and AI Computer Vision software. With features such as object detection, motion detection, face recognition and more, it gives you the power to keep an eye on your home,…

Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient

CORS Misconfiguration Scanner

Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

Irregular methods on regular expressions

Automatic Enumeration Tool based in Open Source tools

🐙 Track down GitHub users.

Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.

WPScan rewritten in Python + some WPSeku ideas

Generate Email, Register for anything, Get the OTP/Link

Meta search for NZB indexers