A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Recovers passwords from pixelized screenshots

🆓免费的 ChatGPT 镜像网站列表，持续更新。List of free ChatGPT mirror sites, continuously updated.

Web Pentesting Fuzz 字典,一个就够了。

KunLun-M是一个完全开源的静态白盒扫描工具，支持PHP、JavaScript的语义扫描，基础安全、组件安全扫描，Chrome Ext\Solidity的基础扫描。

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

Struts2全漏洞扫描利用工具

SRC子域名资产监控

Rogue MySql Server

CodeQL extractor for java, which don't need to compile java source

对于安全学习的一些总结，更新ing，期待 Fork & Star！

python 代码审计项目

基于 jdwp-shellifier 的进阶JDWP漏洞利用脚本（动态执行Java/Js代码并获得回显）

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

自动化检测小工具，主要实现了域名枚举、链接爬取、注入检测、主机扫描、目录枚举、敏感信息检测等功能~

帆软报表漏洞检测工具

HiddenCPG: Large-Scale Vulnerable Clone Detection Using Subgraph Isomorphism of Code Property Graphs

NCTF 2023 challenges and writeups