Awesome GitHub RepositoriesInjection Attacks

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

Ruby is a general-purpose, dynamic programming language built on an object-oriented runtime environment. It treats every piece of data as an object, ensuring a consistent interface for manipulation across the entire system. The language is designed to support programmer productivity through a focus on natural syntax and flexible metaprogramming capabilities. The runtime distinguishes itself through a pure object model that allows for dynamic class modification and runtime method definition. It supports functional programming patterns by encapsulating code blocks as objects that capture their

ModSecurity is an open-source web application firewall and security engine. It functions as an HTTP traffic inspector and intrusion detection system that filters incoming web requests and responses against a set of security rules to block threats and prevent attacks on web servers. The project provides a modular framework for implementing restrictive security policies and custom filtering logic. It identifies and blocks common injection attacks, such as cross-site scripting and SQL injection, while hardening web applications to reduce their overall attack surface. Its broader capabilities in

sqli-labs est une collection d'applications web intentionnellement vulnérables et d'environnements sandbox conçus pour s'entraîner à l'identification et à l'exploitation de vulnérabilités par injection SQL. Il sert de laboratoire d'éducation en cybersécurité où les utilisateurs peuvent expérimenter des exploits de base de données dans un cadre contrôlé. L'environnement fournit des modules spécialisés pour tester un large éventail de vecteurs d'attaque, y compris les injections basées sur les erreurs, les injections aveugles booléennes et les injections basées sur le temps. Il couvre spécifiquement des techniques avancées telles que les injections de second ordre, les requêtes empilées et les attaques ciblant les en-têtes HTTP. Le projet inclut également des exercices axés sur l'évasion des filtres de sécurité et le contournement des pare-feu d'applications web via des techniques comme le retrait de commentaires et l'inadéquation d'impédance. Ces scénarios permettent la simulation de tests d'intrusion réels et d'audits de sécurité de bases de données.

SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API.

SQLi Query Tampering extends and adds custom Payload Generator/Processor in Burp Suite's Intruder. This extension gives you the flexibility of manual testing with many powerful evasion techniques.

A collection of enhancements for Portswigger's popular Burp Suite web penetration testing tool.

A collection of scripts to extend Burp Suite

Publishing plugin which I used for years which helped me to find several bugbounty-worthy XSSes, OpenRedirects and SQLi.

This extension provides a way to discover NoSQL injection vulnerabilities.

Burp Extension that lets you use Burp Collaborator as a DNS server for exfiltrating data via Sqlmap

Burp Show Response Time