A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Web path scanner

📱 objection - runtime mobile exploration

Scanning APK file for URIs, endpoints & secrets.

The Leading Security Assessment Framework for Android.

Tool to look for several security related Android application vulnerabilities

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;)

declutters url lists for crawling/pentesting

Burp Plugin to Bypass WAFs through the insertion of Junk Data

Obtain GraphQL API schema even if the introspection is disabled

Damn Vulnerable MCP Server

graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

ShodanX is a tool to gather information of targets using shodan dorks⚡.

Extract uncompiled, uncompressed SPA code from Webpack source maps.

GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations

Generate Frida bypass scripts for Android APK root and SSL checks.

Self-hosted passive subdomain continous monitoring tool.

Fast & user-friendly web change tracking tool.

A lightweight Python-based tool to extract and enumerate Android components and automatically generate practical ADB commands

GQLSpection - parses GraphQL introspection schema and generates possible queries

Obtain GraphQL API schema despite disabled introspection!

web cache deception detect

Simple XSS vulnerability checker tool very useful with xsschecker.

Revlookup is a tool written in Python3 that performs Reverse DNS on IPs to identify subdomains and new applications

LinkedIn Timestamp Tool is a Python script that extracts the exact date and time a LinkedIn post was created from its URL. This information is valuable for Open Source Intelligence (OSINT) investig…