Stars
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
A Lightweight Face Recognition and Facial Attribute Analysis (Age, Gender, Emotion and Race) Library for Python
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Impacket is a collection of Python classes for working with network protocols.
E-mails, subdomains and names Harvester - OSINT
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWA…
Prowler is the Open Cloud Security for AWS, Azure, GCP, Kubernetes, M365 and more. As agent-less, it helps for continuous monitoring, security assessments & audits, incident response, compliance, h…
Universal Radio Hacker: Investigate Wireless Protocols Like A Boss
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Fast subdomains enumeration tool for penetration testers
The recursive internet scanner for hackers. 🧡
A GPT-empowered penetration testing tool
📱 objection - runtime mobile exploration
Infection Monkey - An open-source adversary emulation platform
WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
The FLARE team's open-source tool to identify capabilities in executable files.
EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.
The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.