Awesome GitHub RepositoriesSQL Injection

This project is an automated security testing suite designed to detect and exploit database vulnerabilities. It functions as a command-line utility that streamlines the identification, verification, and exploitation of web application flaws by automating the injection of malicious payloads into input parameters. The tool provides a comprehensive framework for database enumeration, allowing users to extract schema information, user data, and system configurations from identified injection points. What distinguishes this tool is its sophisticated engine for dynamic payload adaptation and heuris

reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

sqli-labs ist eine Sammlung absichtlich verwundbarer Webanwendungen und Sandbox-Umgebungen, die für das Üben der Identifizierung und Ausnutzung von SQL-Injection-Schwachstellen entwickelt wurden. Es dient als Cybersicherheits-Labor, in dem Benutzer in einer kontrollierten Umgebung mit Datenbank-Exploits experimentieren können. Die Umgebung bietet spezialisierte Module zum Testen einer breiten Palette von Angriffsvektoren, einschließlich fehlerbasierter, boolean-blinder und zeitbasierter Injections. Sie deckt spezifisch fortgeschrittene Techniken wie Second-Order-Injections, Stacked Queries und Angriffe auf HTTP-Header ab. Das Projekt enthält zudem Übungen, die sich auf die Umgehung von Sicherheitsfiltern und Web Application Firewalls durch Techniken wie Kommentar-Stripping und Impedance Mismatch konzentrieren. Diese Szenarien ermöglichen die Simulation von realen Penetrationstests und Audits der Datenbanksicherheit.

Automated NoSQL database enumeration and web application exploitation tool.

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

massive SQL injection vulnerability scanner

Automatic SQL injection with Charles and sqlmap api

mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse

SQLi-Hunter is a simple HTTP / HTTPS proxy server and a SQLMAP API wrapper that makes digging SQLi easy.

NoSql Injection CLI tool, for finding vulnerable websites using MongoDB.

Evil SQL Client (ESC) is an interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features. While ESC can be a handy SQL Client for daily tasks, it was originally designed for targeting SQL Servers during penetration tests and red team engagements. The intent of the project is to provide an .exe, but also sample files for execution through mediums like msbuild and PowerShell.

Gather urls from wayback machine then test each GET parameter for sql injection.

SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing

Blind SQL Injection Tool with Golang

Messy BurpSuite plugin for SQL Truncation vulnerabilities.

A python library to automate time-based blind SQL injection