Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OXML_XEE on steroids)

A tool for append URLs, skipping duplicates & combine parameters.

DNSTake — A fast tool to check missing hosted DNS zones that can lead to subdomain takeover

Login hunter of default credentials for administrative web interfaces leveraging NNdefaccts dataset.

Automated blind-xss search for Burp Suite

API Security Project aims to present unique attack & defense methods in API Security field

Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files

Quick SQLMap Tamper Suggester

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Searching for virtual hosts among non-resolvable domains

Hidden parameters discovery suite

Change monitoring app that checks the content of web pages in different periods.

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more...

Exfiltrate blind remote code execution output over DNS via Burp Collaborator.

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

Burp Plugin to decrypt AES encrypted traffic on the fly

This repo is meant to be a list of companies that hire security people full remote.

Fetch many paths for many hosts - without killing the hosts

monitors certificate transparency logs

A burp suite extension that reviews backup, old, temporary and unreferenced files on web server for sensitive information (OWASP OTG-CONFIG-004)

Fetches javascript file from a list of URLS or subdomains.

Small utility program to perform multiple operations for a given subnet/CIDR ranges.

burpsuite extension for check unauthorized vulnerability

A Burp Suite plugin/extension that offers a shell in Burp. Both useful for OS Command injection and LFI exploration

Collections of tools and methods created to aid in OSINT collection

Gotator is a tool to generate DNS wordlists through permutations.

Rewrite of the popular wireless network auditor, "wifite" - original by @derv82

The project contains multiple shell scripts for automating the tasks during recon.