Open-source alternatives to Wordlists

Wuzz is an interactive command line HTTP client and request inspector designed for capturing, reviewing, and analyzing outgoing network calls and their payloads. It functions as a terminal-based tool for debugging API issues and testing web endpoints. The tool provides specialized filtering for response bodies, using regular expressions and format-specific query syntaxes tailored for JSON and HTML data. It allows for the persistence of captured requests and responses to disk to facilitate the reproduction of network issues and offline analysis. User settings and default request behaviors are

Commonspeak2

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct GraphQL schemas.

CyberChef is a web-based application designed for performing complex data encoding, decoding, encryption, and analysis tasks. It provides a visual interface where users construct data transformation pipelines by chaining modular operations together, allowing raw input to be processed into a desired output format entirely within the local browser environment. The tool functions as a client-side cryptographic workbench, ensuring that all data processing logic remains local to the user's machine to maintain privacy and eliminate server-side overhead. By utilizing functional pipeline composition

This project is a comprehensive software fuzzing knowledge base and technical guide designed for discovering software bugs and vulnerabilities. It serves as a resource for implementing coverage-guided, structure-aware, and hybrid fuzzing across various targets, including compiled binaries and hardware kernels. The resource provides specialized guidance on using grammars and defined data formats to generate syntactically valid inputs for complex APIs. It also details methods for combining grey-box fuzzing with symbolic execution to reach deep execution paths and utilizes binary instrumentation

A collection of custom security tools for quick needs.

A golang utility to spider through a website searching for additional links.

Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

Gotator is a tool to generate DNS wordlists through permutations.

This project is a general-purpose command-line filter that provides an interactive interface for processing standard input streams. It enables real-time fuzzy searching, data selection, and transformation, allowing users to navigate complex information or file systems directly within their terminal. By utilizing a pipe-oriented architecture, it integrates into existing shell pipelines and workflows to facilitate efficient data exploration. What distinguishes this tool is its highly extensible, event-driven design that allows for deep integration with external processes. It supports asynchrono

Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets