🎯 Command Injection Payload List

recon for bug hunters

Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark.

The OWASP Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a "low level" penetration testing guide that describes tech…

Three complete IT / Cybersecurity resume for the following job roles: Systems Administration, SOC Analyst, & Penetration Tester.

Source code for Hacker101.com - a free online web and mobile security class.

Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires no maintenance!

Access large language models from the command-line

Identify changes made to a filesystem made by a malicious file

A Linux version of the Procmon Sysinternals tool

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

A collection of AWS penetration testing junk

A curated list of resources for learning about application security

Automated HTTP Request Repeating With Burp Suite

World's fastest and most advanced password recovery utility

My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty.

Collection of the cheat sheets useful for pentesting

Damn Vulnerable Web Application (DVWA)

Web app that provides basic navigation and annotation of ATT&CK matrices

Open-source vulnerability disclosure and bug bounty program database

Utilities for MITRE™ ATT&CK

HackBar plugin for Burpsuite

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules thro…

Another way to bypass WAF Cheat Sheet (draft)

Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and macOS applications.

The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.

Hunspell UTF8 dictionaries. These work with Sublime Text. [Spell check]