A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Hunt down social media accounts by username across social networks

Automatic SQL injection and database takeover tool

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

🕵️‍♂️ Offensive Google framework.

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Impacket is a collection of Python classes for working with network protocols.

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 56 Methods

E-mails, subdomains and names Harvester - OSINT

Most advanced XSS scanner.

The Rogue Access Point Framework

The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

Incredibly fast crawler designed for OSINT.

Prowler is the Open Cloud Security for AWS, Azure, GCP, Kubernetes, M365 and more. As agent-less, it helps for continuous monitoring, security assessments & audits, incident response, compliance, h…

Scapy: the Python-based interactive packet manipulation program & library.

Proxy server to bypass Cloudflare protection

Fast subdomains enumeration tool for penetration testers

Credentials recovery project

an awesome list of honeypot resources

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.

The recursive internet scanner for hackers. 🧡

A swiss army knife for pentesting networks

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

📱 objection - runtime mobile exploration

An advanced memory forensics framework

Multi-Cloud Security Auditing Tool

Web application fuzzer

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

HTTP parameter discovery suite.