A list of useful payloads and bypass for Web Application Security and Pentest/CTF

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, se…

Metasploit Framework

一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy serv…

A plugin for Mac WeChat

Redis is an in-memory database that persists on disk. The data model is key-value, but many different kind of values are supported: Strings, Lists, Sets, Sorted Sets, Hashes

A little tool to play with Windows security

Pre-Built Vulnerable Environments Based on Docker-Compose

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

Gitbook

GO Simple Tunnel - a simple tunnel written in golang

🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxies,nat forwarding in different lan,TCP/UDP po…

Impacket is a collection of Python classes for working with network protocols.

Web path scanner

articles

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。

PowerSploit - A PowerShell Post-Exploitation Framework

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

Fast subdomains enumeration tool for penetration testers

This is a webshell open source project

Credentials recovery project

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

OneForAll是一款功能强大的子域收集工具

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

windows-kernel-exploits Windows平台提权漏洞集合

You Know, For WEB Fuzzing ! 日站用的字典。

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve…