A list of useful payloads and bypass for Web Application Security and Pentest/CTF

World's fastest and most advanced password recovery utility

A collection of awesome penetration testing resources, tools and other shiny things

Source code for Hacker101.com - a free online web and mobile security class.

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Open-Source Phishing Toolkit

🔗 The 𝘥𝘦 𝘧𝘢𝘤𝘵𝘰 standard, self hosted, powerful and customizable, URL shortener in PHP

Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and th…

Mobile_Detect is a lightweight PHP class for detecting mobile devices (including tablets). It uses the User-Agent string combined with specific HTTP headers to detect the mobile environment.

This is a webshell open source project

An open-source post-exploitation framework for students, researchers and developers.

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

Accurately Locate Smartphones using Social Engineering

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

Modlishka. Reverse Proxy.

Automated Mass Exploiter

🚡 A modern, powerful, and robust URL shortener

Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

Converts .py to .exe using a simple graphical interface

The LAZY script will make your life easier, and of course faster.

Python Remote Administration Tool (RAT)

File upload vulnerability scanner and exploitation tool.

This is Advance Phishing Tool ! OTP PHISHING

Get Keyboard,Mouse,ScreenShot,Microphone Inputs from Target Computer and Send to your Mail.

Th3Inspector 🕵️ Best Tool For Information Gathering 🔎

Phishing Campaign Toolkit

OSINT Tool for Finding Passwords of Compromised Email Addresses

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

An evil RAT (Remote Administration Tool) for macOS / OS X.

Whoami provides enhanced privacy, anonymity for Debian and Arch based linux distributions