Stars
graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.
Archive Alchemist is a tool for creating specially crafted archives to test extraction vulnerabilities.
High-performance DNS validator using template-based verification
jxscout superpowers JavaScript analysis for security researchers
The Template Injection Playground allows to test a large number of the most relevant template engines for template injection possibilities.
Chrome extension for automating CSPT discovery
Free, libre, effective, and data-driven wordlists for all!
A chrome/Firefox extension to retrieve and load react javascript chunks all at once for a wide range of javascript techs
Sasori is a dynamic web crawler powered by Puppeteer, designed for lightning-fast endpoint discovery.
A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.
A collection of Server-Side Prototype Pollution gadgets and exploits
Informational Repository tracking times that real world bugs have come out of CTF challenges intentionally or otherwise
grep rough audit - source code auditing tool
Mobile Edge-Dynamic Unified Security Analysis
TInjA is a CLI tool for testing web pages for template injection vulnerabilities and supports 44 of the most relevant template engines for eight different programming languages.
ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.
The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct GraphQL schemas.
An step by step fuzzing tutorial. A GitHub Security Lab initiative
Asset definitions for an organization's external attack surface
Escalate your SSRF vulnerabilities on Modern Cloud Environments. `surf` allows you to filter a list of hosts, returning a list of viable SSRF candidates.
Identify virtual hosts by similarity comparison
An incredibly fast proxy checker & IP rotator with ease.
⚡ Blazing-fast tool to grab screenshots of your domain list right from terminal.