Lists (2)
Stars
🕵️♂️ All-in-one OSINT tool for analysing any website
Easy to use open source fast database for search | Good alternative to Elasticsearch now | Drop-in replacement for E in the ELK stack
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
Collection of methodology and test case for various web vulnerabilities.
Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...
A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference
Top disclosed reports from HackerOne
Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
A curated list of amazingly awesome Burp Extensions
This repository contain a lot of web and api vulnerability checklist , a lot of vulnerability ideas and tips from twitter
A collection of awesome one-liner scripts especially for bug bounty tips.
List of Github repositories and articles with list of dorks for different search engines
Collection of some common wordlists such as RDP password, user name list, ssh password wordlist for brute force. IP Cameras Default Passwords.
A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.
403/401 Bypass Methods + Bash Automation + Your Support ;)
Burp Plugin to Bypass WAFs through the insertion of Junk Data
An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.
Scope aggregation tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!
An exhaustive list of all the possible ways you can chain your Blind SSRF vulnerability
These are my checklists which I use during my hunting.
crawls the website and finds broken social media links that can be hijacked
A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.
Bug Bounty Tricks and useful payloads and bypasses for Web Application Security.
Scrape domain names from SSL certificates of arbitrary hosts