Awesome GitHub RepositoriesWAF Bypass Techniques

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

XSStrike is a security tool designed to detect cross-site scripting vulnerabilities through parameter fuzzing and web response analysis. It functions as a web application fuzzer and vulnerability scanner that identifies injection points and security flaws. The project includes a specialized utility for detecting blind XSS, where payloads execute asynchronously or on separate pages. It also features a JavaScript library auditor to identify outdated libraries with known vulnerabilities and a dedicated tool for identifying and bypassing web application firewalls using various evasion techniques.

sqli-labs هي مجموعة من تطبيقات الويب الضعيفة عمداً وبيئات الاختبار المصممة لممارسة تحديد واستغلال ثغرات حقن SQL. تعمل كمختبر تعليمي للأمن السيبراني حيث يمكن للمستخدمين تجربة استغلال قواعد البيانات في بيئة خاضعة للرقابة. توفر البيئة وحدات متخصصة لاختبار مجموعة واسعة من ناقلات الهجوم، بما في ذلك الحقن القائم على الخطأ، والحقن الأعمى القائم على المنطق البولي، والحقن القائم على الوقت. تغطي بشكل خاص تقنيات متقدمة مثل حقن الدرجة الثانية، والاستعلامات المكدسة، والهجمات التي تستهدف رؤوس HTTP. يتضمن المشروع أيضاً تمارين تركز على تجاوز مرشحات الأمان وتجاوز جدران حماية تطبيقات الويب من خلال تقنيات مثل تجريد التعليقات وعدم تطابق المعاوقة. تسمح هذه السيناريوهات بمحاكاة اختبار الاختراق الواقعي وتدقيق أمن قواعد البيانات.

Dalfox is an automated web application security tool specifically designed for discovering and verifying cross-site scripting vulnerabilities. It functions as an XSS vulnerability scanner that analyzes HTTP parameters and DOM structures to identify reflected, stored, and blind injection points. The project distinguishes itself by providing a Model Context Protocol server and a REST API, allowing artificial intelligence agents and remote interfaces to trigger and manage security scans programmatically. It utilizes a payload mutation engine and fingerprinting strategies to execute WAF evasion t

phpggc is a security assessment utility and command-line tool designed for the automated generation, obfuscation, and wrapping of serialized object chains. It functions as a gadget chain framework used to identify and verify remote code execution vectors by testing for PHP object injection vulnerabilities. The project provides a modular system for constructing complex serialized object sequences and includes a dedicated payload obfuscator to transform byte streams for bypassing web application firewalls and security filters. It also features a generator for wrapping serialized data into archi