pentest-tools

pentest-tools A collection of custom security tools for quick needs. Important note ‼ A big clean occured in 2022-11 ‼ Some useless/not working scripts have been archived and some others have been moved to their own repository to get more visibility, feel free to check them: apk-analyzer...

sqlifinder

Pythonで作られたSQLインジェクションスキャナーです。 機能 • インストール • 使い方 • sqlifinderは、waybackurls、Webクローラー、SQLインジェクションペイロードを使用して、WebアプリケーションのGETベースのSQLインジェクション脆弱性を検出する機能を持つツールです。 機能 高速かつ強力なスキャナー Webクローラーとwaybackurlsを含む 使い方 python3 sqlifinder.py -h これによりツールのヘルプが表示されます。サポートされているすべてのスイッチがここに表示されます。 インストール Sqlifinderに必要なもの...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

waybackurls

waybackurls 標準入力から改行区切りのドメインを受け取り、Wayback Machine から .domain の既知のURLを取得し、標準出力に出力します。 使用例: ▶ cat domains.txt | waybackurls urls インストール: ▶ go install github.com/tomnomnom/waybackurls@latest クレジット このツールは @mhmdiaa の waybackurls.py スクリプトに触発されました。素晴らしいアイデアをありがとうございます！...

One-Liner-Collections

单行命令集合 此仓库包含带有描述和安装要求的单行命令列表 ──────────────────────────────────────────────────────────────────────── SQL 注入 安装要求 1. Subfinder : https://github.com/projectdiscovery/subfinder 2. GAU : https://github.com/lc/gau 3. GF : https://github.com/tomnomnom/gf 4. Findomain :...

xss-security-scanner

XSS Security Scanner A professional web-based XSS vulnerabili...

EndExt - Go Tool For Extracting All The Possible Endpoints From The JS Files

EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look for all t...

Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. Requirements: Go Language, Python 2.7 or Python 3. System requirements: Recommended to run on vps with 1VCPU and 2GB ram. Tools used - You must need to install...

meg+ - Automated Reconnaissance Wrapper

This wrapper will automate numerous tasks and help you during your reconnaissance process. The script finds common issues, low hanging fruit, and assists you when approaching a target. meg+ also allows you to scan all your in-scope targets on HackerOne in one go — it simply retrieves them using a...