Awesome GitHub RepositoriesWeb Exploitation

Gobuster is a command-line security utility designed for brute-force discovery of hidden infrastructure and content. It operates by systematically testing wordlists against target network services to identify files, directories, subdomains, and cloud storage buckets. The tool utilizes a concurrent worker pool to execute these requests in parallel, ensuring efficient scanning across various network environments. The project distinguishes itself through a modular plugin architecture that supports multiple discovery modes, including HTTP, DNS, and TFTP. This design allows for protocol-agnostic r

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The fram

This is a webshell open source project

fuzzdb is a collection of datasets designed for web application penetration testing and dynamic fuzzing. It provides a fuzzing payload dictionary, a resource discovery wordlist, and a fault injection dataset containing corrupted Unicode, null bytes, and escape codes to trigger application crashes and logic errors. The project includes a security filter bypass list featuring polyglots and encoded strings to evade web application firewalls and input validation filters. It also provides a comprehensive web application penetration testing dataset specifically for identifying flaws such as cross-s

ysoserial is a security research tool and payload generator designed to identify and exploit insecure Java deserialization. It functions as a framework for creating malicious serialized objects that can trigger remote code execution on Java virtual machines. The project provides a library of known gadget chains, which are sequences of vulnerable class calls that achieve arbitrary command execution during the deserialization process. It automates the generation of these payloads by leveraging common third-party libraries. The tool covers capabilities for security penetration testing, Java app

w3af is a web penetration testing suite and security audit framework designed to identify and exploit vulnerabilities in web applications. It functions as a vulnerability scanner that crawls targets to find injection points and a fuzzer used to discover hidden endpoints and test input validation. The project distinguishes itself by providing an intercepting HTTP proxy for capturing and modifying traffic, combined with a knowledge-base driven exploitation system. It enables the execution of security exploits to gain remote shell access and supports post-exploitation activities, such as routing

tplmap es una herramienta de seguridad diseñada para la detección y explotación de vulnerabilidades de inyección de plantillas en el lado del servidor (SSTI). Funciona como un escáner automatizado para identificar contextos de motores de plantillas vulnerables y proporciona un framework para lograr la ejecución remota de código. La herramienta se centra en traducir solicitudes de alto nivel a sintaxis específica del motor para ejecutar comandos del sistema operativo y eludir sandboxes de aplicaciones. Además, permite el acceso remoto al sistema de archivos, facilitando la lectura, escritura y transferencia de archivos entre una máquina local y un servidor objetivo. Otras capacidades incluyen la posibilidad de lanzar servidores locales vulnerables para simular entornos defectuosos y verificar payloads. El proyecto también admite la integración con proxies de seguridad web para automatizar la inyección de payloads de prueba en el tráfico interceptado.

GitTools es una colección de utilidades de seguridad diseñadas para identificar, escanear y explotar directorios de control de versiones expuestos en servidores web. El proyecto proporciona herramientas para localizar directorios Git públicamente accesibles y extraer su contenido para identificar fugas de información. La suite incluye capacidades para descargar archivos y estructuras de carpetas desde repositorios remotos incluso cuando el listado de directorios está deshabilitado. También cuenta con un sistema de recuperación que itera a través de objetos de commit para restaurar contenido a partir de datos de control de versiones incompletos o corruptos.

phpggc is a security assessment utility and command-line tool designed for the automated generation, obfuscation, and wrapping of serialized object chains. It functions as a gadget chain framework used to identify and verify remote code execution vectors by testing for PHP object injection vulnerabilities. The project provides a modular system for constructing complex serialized object sequences and includes a dedicated payload obfuscator to transform byte streams for bypassing web application firewalls and security filters. It also features a generator for wrapping serialized data into archi

ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl

A high performance offensive security tool for reconnaissance and vulnerability scanning

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

p0wny@shell:~# is a very basic, single-file, PHP shell. It can be used to quickly execute commands on a server when pentesting a PHP application. Use it with caution: this script represents a security risk for the server.

Astra is a security analysis system and scanner designed to identify vulnerabilities and security flaws in REST API endpoints. It functions as a security testing tool that automatically detects common API weaknesses during development and deployment cycles. The project provides a graphical interface for triggering and monitoring security scanning processes, removing the requirement for manual command line execution. This management UI allows for the oversight of scanning workflows and the retrieval of vulnerability reports. The system supports the import of collection files to map endpoints

SSRF (Server Side Request Forgery) testing resources

Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.

IIS Short Name Scanner - 2012-2023 & Still Giving...

🔪 :octocat: Leak git repositories from misconfigured websites

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.

Scriptable network authentication cracker