A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Automatic SQL injection and database takeover tool

Most advanced XSS scanner.

Cross-platform lib for process and system monitoring in Python

A swiss army knife for pentesting networks

(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

HTTP parameter discovery suite.

Virtual Python Environment builder

Tool for Active Directory Certificate Services enumeration and abuse

Mimikatz implementation in pure Python

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

BloodyAD is an Active Directory Privilege Escalation Framework

Find interesting Amazon S3 Buckets by watching certificate transparency logs.

This is just an semi-automated fully working, no-bs, non-metasploit version of the public exploit code for MS17-010

Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported!

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

bypass-url-parser

WiFi Penetration Testing & Auditing Tool

A script that helps you understand why your E-Mail ended up in Spam

Modified version of the passing-the-hash tool collection made to work straight out of the box

LDAP library for auditing MS AD

Your template-based BloodHound terminal companion tool

FindUncommonShares is a Python script allowing to quickly find uncommon shares in vast Windows Domains, and filter by READ or WRITE accesses.

A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain.

A tool to generate a wordlist from the information present in LDAP, in order to crack passwords of domain accounts.

Toolkit for Playing with Wi-Fi Probe Requests