clusterfuzzlite

ClusterFuzzLite ClusterFuzzLite is a continuous fuzzing solution that runs as part of Continuous Integration CI workflows to find vulnerabilities faster than ever before. With just a few lines of code, GitHub users can integrate ClusterFuzzLite into their workflow and fuzz pull requests to catch...

kanha

Kanha - A web-app pentesting suite written in rust 🦀 Installation ⦾ Subcommands ⦾ Contribute Kanha is a tool that can help you perform, a variety of attacks based on the target domain . With just kanha you can do, Fuzzing, Reverse dns lookup, common http response, subdomain takeover detection and...

ParamSpider

paramspider Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing 📖 About • 🏗️ Installation • ⛏️ Usage • 🚀 Examples • 🤝 Contributing • About paramspider allows you to fetch URLs related to any domain or a list of domains from Wayback achives. It filters out "boring"...

fuzzbench

FuzzBench: Fuzzer Benchmarking As a Service FuzzBench is a free service that evaluates fuzzers on a wide variety of real-world benchmarks, at Google scale. The goal of FuzzBench is to make it painless to rigorously evaluate fuzzing research and make fuzzing research easier for the community to...

SecLists

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...

toothpicker

ToothPicker ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon bluetoothd and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This...

fuzzuli

fuzzuli Motivation • Background • Installation • Usage • Running fuzzuli • Tool Page fuzzuli is a url fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain. Motivation...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

mdk4

MDK4 MDK is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses. About MDK4 MDK4 is a new version of MDK3. MDK4 is a Wi-Fi testing tool from E7mer, ASPj of k2wrlz, it uses the osdep library from the aircrack-ng project to inject frames on several operating systems. Many part...

Platbox

Platbox UEFI and SMM Assessment Tool Features Platbox is a tool that helps assessing the security of the platform: Dumps the platform registers that are interesting security-wise Flash Locks MMIO and Remapping Locks SMM Base and Locks MSRs RW access to the PCI configuration space of devices. RW t...

kitty

Introduction | Sulley: Boo? | Boo: Kitty! What is Kitty? Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE's Sulley and Michael Eddington's and now Deja Vu Security's Peach Fuzzer . Goal root@kitploit: When we started writing Kitty, our goal w...

ATFuzzer

ATFuzzer "Opening Pandora's Box through ATFuzzer: Dynamic Analysis of AT Interface for Android Smartphones" is accepted to the 35th Annual Computer Security Applications Conference ACSAC 2019. https://syed-rafiul-hussain.github.io/wp-content/uploads/2019/11/atfuzz.pdf Abstract This paper focuses ...

WAFNinja

WAFNinja root@kitploit: WAFNinja - Penetration testers favorite for WAF Bypassing WAFNinja is a CLI tool written in Python. It shall help penetration testers to bypass a WAF by automating steps necessary for bypassing input validation. The tool was created with the objective to be easily...

difuze

difuze: Fuzzer for Linux Kernel Drivers This repo contains all the sources including setup scripts, you need to get difuze up and running. Tested on Ubuntu = 14.04.5 LTS 0. Running difuze from Docker Refer the readme As explained in our paper, There are two main components of difuze: Interface...

LibAFL

LibAFL, the fuzzer library Advanced Fuzzing Library - Slot your own fuzzers together and extend their features using Rust. LibAFL is a collection of reusable pieces of fuzzers, written in Rust, it gives you many of the benefits of an off-the-shelf fuzzer, while being completely customizable. Some...

scorecard

OpenSSF Scorecard...

cerebro-red-v2

CEREBRO-RED v2 Research Edition Autonomous Local LLM Red Teaming Suite A research-grade framework for automated vulnerability discovery in local LLMs using Agentic Fuzzing and Adaptive Adversarial Mutation AAM. Research Goals Implement PAIR Algorithm Prompt Automatic Iterative Refinement from...

vaf

vaf A fast, simple, and feature rich web fuzzer written in nim vaf is a cross-platform web fuzzer with a lot of features. Some of its features include: Fast threading HTTP header fuzzing Proxying your own feature! And more... Installing...

bugbounty-arsenal-resources

BugBounty Arsenal Resources Curated workflows, tools and references for bug bounty hunters and web security researchers. What is BugBounty Arsenal? BugBounty Arsenal is a practical web testing platform focused on recon workflows, endpoint discovery and security testing utilities. The goal is to...