A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Set up a personal VPN in the cloud

Most advanced XSS scanner.

CTF framework and exploit development library

Fast subdomains enumeration tool for penetration testers

Credentials recovery project

A swiss army knife for pentesting networks

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

A utility for arming (creating) many bees (micro EC2 instances) to attack (load test) targets (web applications).

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

Automated All-in-One OS Command Injection Exploitation Tool.

The Leading Security Assessment Framework for Android.

Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public expl…

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, co…

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

File upload vulnerability scanner and exploitation tool.

Tweets metadata scraper & activity analyzer

Automated Security Testing For REST API's

Privilege Escalation Project - Windows / Linux / Mac

CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 180 other CMSs

JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

Know the dangers of credential reuse attacks.

Abusing Certificate Transparency logs for getting HTTPS websites subdomains.

The most complete open-source tool for Twitter intelligence analysis

pwning IPv4 via IPv6