A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Automatic SQL injection and database takeover tool

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

🕵️‍♂️ Offensive Google framework.

Most advanced XSS scanner.

The Rogue Access Point Framework

Incredibly fast crawler designed for OSINT.

The recursive internet scanner for hackers. 🧡

A swiss army knife for pentesting networks

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

HTTP parameter discovery suite.

IntelOwl: manage your Threat Intelligence at scale

An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws

A Windows reverse shell payload generator and handler that abuses the http(s) protocol to establish a beacon-like reverse shell.

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

All In One Web Recon

LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping

ICS/SCADA honeypot

An XSS exploitation command-line interface and payload generator.

Generates millions of keyword-based password mutations in seconds.

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

A fuzzer for detecting open redirect vulnerabilities

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

Search & Parse Password Leaks

DoSinator is a powerful Denial of Service (DoS) testing tool developed in Python.

The purpose of this tool is: 1. to transliterate and generate possible usernames out of a full names list that may include names written in multiple (non-English) languages, common problem occurrin…

Azure Service Subdomain Enumeration