feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

secator

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

monsoon

monsoon A fast HTTP enumerator that allows you to execute a large number of HTTP requests, filter the responses and display them in real-time monsoon is a fast and flexible HTTP fuzzer that can be used for a wide variety of actions ranging from content discovery to credential bruteforcing. You ca...

ffuf

ffuf - Fuzz Faster U Fool Un fuzzer web rápido escrito en Go. Instalación Ejemplo de uso Descubrimiento de contenido Descubrimiento de vhost Fuzzing de parámetros Fuzzing de datos POST Uso de mutador externo Archivos de configuración Ayuda Modo interactivo Instalación Descarga un binario...

CWFF

CWFF - Custom wordlists for fuzzing CWFF is a tool that creates a special High quality fuzzing/content discovery wordlist for you at the highest speed possible using concurrency and it's heavily inspired by @tomnomnom's Who, What, Where, When, Wordlist NahamCon2020. Usage root@kitploit: CWFF -h...

filebuster

Filebuster 一个极快且灵活的Web模糊测试工具 它是什么？ Filebuster 是一个HTTP模糊测试/内容发现脚本，拥有大量功能，设计易于使用且速度飞快！它使用了世界上（PERL领域）最快的HTTP类之一——Furl::HTTP。同时，线程模型经过优化，以尽可能快地运行。 功能特性 它集成了大量功能，例如： 字典列表的正则模式 支持HTTP/HTTPS/SOCKS代理 允许使用通配符指定多个字典列表 额外的文件扩展名 可调整的超时和重试次数 可调整的延迟/限速 基于HTTP状态码、响应长度或头部/正文中的单词隐藏结果 支持自定义Cookie 支持自定义请求头...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

kiterunner

Kiterunner 介绍 长期以来，内容发现一直专注于查找文件和文件夹。虽然这种方法对于托管静态文件或在部分路径下返回 3xx 响应的传统 Web 服务器有效，但对于现代 Web 应用程序，尤其是 API，它已不再高效。 随着时间的推移，我们看到了大量时间投入到提高内容发现工具的速度上，以便可以使用更大的字典，但内容发现的艺术本身却没有得到创新。 Kiterunner 不仅能够以极快的速度执行传统内容发现，还能对现代应用程序中的路由/端点进行暴力破解。 现代应用框架（如 Flask、Rails、Express、Django 等）遵循显式定义路由的范式，这些路由期望特定的 HTTP...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

cansina

Cansina Cansina 是一款 Web 内容发现应用程序。 众所周知，Web 应用程序不会发布其所有资源或公共链接，因此发现这些资源的唯一方法是请求它们并检查响应。 Cansina 的职责是帮助您发出请求，并过滤和检查响应，以区分这是现有资源还是只是令人讨厌的伪装的 404。 欢迎提出功能请求和意见。 Cansina 包含在 BlackArch Linux 中，快来试试吧！ 安装 root@kitploit: pip install cansina 如果您不想污染环境来测试 cansina，只需创建一个虚拟环境。 用法 维基 包含完整的文档和示例。但作为快速示例：...

rustbuster

rustbuster 一个全面的Web模糊测试与内容发现工具 简介 查看博文：介绍 Rustbuster——一个全面的Web模糊测试与内容发现工具 下载 你可以从这里下载预编译的二进制文件。 安装 root@kitploit: installrustbuster echo "Installing latest version of Rustbuster" latestversion=curl -s https://github.com/phra/rustbuster/releases | grep "rustbuster-v" | head -n1 | cut -d'/' -f6 ech...

crawpy

Crawpy Yet another content discovery tool written in python. What makes this tool different than others: Sends asynchronous HTTP requests, fast Calibration mode, applies filters on its own Recursive scan mode with additional flags Report generation, you can later go and check your results Multipl...

crawpy

Crawpy 另一个用Python编写的内容发现工具。 该工具与其他工具的不同之处在于： 发送异步HTTP请求，速度快 校准模式，自动应用过滤器 递归扫描模式，带有额外标志 报告生成，之后可以查看结果 多URL扫描 示例运行 启用自动校准和递归模式的示例运行 示例报告 示例报告可以在这里找到 root@kitploit: https://morph3.blog/crawpy/example.html https://morph3.blog/crawpy/example.txt 安装 root@kitploit: git clone...

chameleon

Chameleon Chameleon proporciona un mejor descubrimiento de contenido mediante el uso del conjunto de huellas de tecnologías de wappalyzer junto con listas de palabras personalizadas adaptadas a cada tecnología detectada. La herramienta es altamente personalizable y permite a los usuarios añadir s...

vigolium v0.4.4

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

ctf-toolkit

Bug Bounty Recon Tool 🚀 The Ultimate Bug Bounty Recon Tool...

EUVD-2018-13477

Malware in sbrugna...

h1-ctf: [ Hacky Holidays CTF ] Completely taken down the Grinch Networks

Day 1 - Robot flag We're presented with sample ui page without any function. So I guessed content discovery is the best way to find flag. And robots.txt came to my mind and found the flag. https://hackyholidays.h1ctf.com/robots.txt Response User-agent: Disallow: /s3cr3t-ar3a Flag:...

h1-ctf: Hackyholidays CTF writeup

Writeup for the hackyholidays CTF This CTF consisted of 12 challenges released daily in the 12 days leading up to christmas. The goal was to stop the Grinch from ruining christmas by slowly destroying the apps that he used to terrorize Santa and his elfs. The challenges were: 1. Robots.txt 2. DOM...