Awesome GitHub RepositoriesExploit Payloads

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

fuzzDicts is a repository of curated wordlists and dictionaries designed for web application fuzzing. It provides collections of strings and payloads used to discover hidden files, subdomains, and security vulnerabilities. The project includes specialized libraries for different security testing vectors, such as dictionaries for common request and cookie parameters, lists of common subdomain prefixes, and collections of passwords and default vendor credentials for brute-force testing. It also maintains a security payload library containing character sequences used to identify flaws like SQL i

This project is a bug bounty resource directory, vulnerability research cheatsheet, and web security payload library. It serves as a centralized collection of curated payloads and common attack vectors used to identify security vulnerabilities in web applications. The repository provides a directory of platforms, books, and tools to support vulnerability discovery skills. It includes a reference for tested payloads and techniques used to trigger bugs and identify vulnerabilities during security audits. The content covers web application pentesting, security vulnerability testing, and general

Peda es una suite de herramientas de seguridad y framework de desarrollo de exploits diseñado para análisis binario, automatización de depuradores e inspección de memoria. Funciona como un conjunto de scripts de Python que extienden un depurador para automatizar el análisis de archivos compilados y la inspección de la memoria de procesos. El proyecto proporciona utilidades especializadas para la investigación de corrupción de memoria, incluyendo una utilidad de generación de payloads para crear patrones cíclicos para descubrir desbordamientos de búfer y un buscador de gadgets para localizar secuencias de programación orientada al retorno (ROP) dentro de binarios. Se diferencia al ofrecer una herramienta de visualización que transforma datos crudos de registros, desensamblado y memoria en texto codificado por colores para simplificar el análisis de los estados de la CPU. El framework cubre una amplia gama de capacidades, incluyendo análisis de seguridad binaria para detectar protecciones, escaneo de memoria mediante expresiones regulares y la capacidad de mapear entornos de procesos directamente desde el kernel del sistema. También incluye herramientas para modificar direcciones de memoria y generar plantillas de shellcode.

w3af is a web penetration testing suite and security audit framework designed to identify and exploit vulnerabilities in web applications. It functions as a vulnerability scanner that crawls targets to find injection points and a fuzzer used to discover hidden endpoints and test input validation. The project distinguishes itself by providing an intercepting HTTP proxy for capturing and modifying traffic, combined with a knowledge-base driven exploitation system. It enables the execution of security exploits to gain remote shell access and supports post-exploitation activities, such as routing