authcov

AuthCov Web 应用程序授权覆盖扫描。 简介 AuthCov 使用 Chrome 无头浏览器，以预定义用户的身份登录，爬取您的 Web 应用程序。在爬取阶段，它会拦截并记录 API 请求以及加载的页面。下一阶段，它会以另一个用户账户（即“入侵者”）登录，并尝试访问之前发现的每一个 API 请求或页面。对于定义的每个入侵者用户，重复此步骤。最后，它会生成一份详细报告，列出发现的资源以及入侵者用户是否能够访问这些资源。 扫描本地 Wordpress 实例生成的示例报告： 功能特性 支持单页应用和传统多页应用 处理基于令牌和基于 Cookie 的身份验证机制 生成 HTML 格式的深入...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts 是一个 Bing.com 网页抓取器，通过 IP 地址发现主机名。 描述 Bing-ip2hosts 是一个 Bing.com 网页抓取器，通过 IP 地址发现主机名。Bing 是微软的旗舰搜索引擎，前身为 MSN Search 和 Live Search。 它提供了一个搜索引擎独有的功能——允许按 IP 地址进行搜索。Bing-ip2hosts 利用了这个功能。 它可以用于发现子域名和其他相关域名。它还有助于识别在共享主机环境中托管的网站。该技术遵循渗透测试或漏洞赏金侦察阶段的最佳实践，用以扩展目标的攻击面。 与许多其他通过网页抓...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts is a Bing.com web scraper to discover hostnames by IP address. Description Bing-ip2hosts is a Bing.com web scraper that discovers hostnames by IP address. Bing is the flagship Microsoft search engine formerly known as MSN Search and Live Search. It provides a feature...

grubcrawler

Agentic web crawler with anti-detection, vision fallback, and peer-to-peer mesh. Endpoints · Mesh · Anti-Detection · Ghost Protocol · Live Stream · MCP Tools · Quick Start · Benchmarks · Architecture Full-stack web crawling engine with JavaScript rendering, Camoufox anti-detect browser, per-reque...

Pegasus-Pentest-Arsenal

Pegasus Pentest Arsenal PPA root@kitploit: /\ / | / \ | \ | || | | | | / | /| |/ |/ |/ ,/; ; ; ,'/|; ,/,/, ,'/ |;/,/,/,/| ,/; |;|/,/,/,/,/| ,/'; |;|,/,/,/,/,/| ,/'; |;|/,/,/,/,/,/|, / ; |;|,/,/,/,/,/,/| / ,'; |;|/,/,/,/,/,/,/| /,/'; |;|,/,/,/,/,/,/,/| /;/ '; |;|/,/,/,/,/,/,/,/| ██████╗ ███████╗...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

Scrapegraph-ai

🚀 ¿Buscas una forma aún más rápida y sencilla de hacer scraping a escala solo 5 líneas de código? ¡Echa un vistazo a nuestra versión mejorada en ScrapeGraphAI.com! 🚀 🕷️ ScrapeGraphAI: Solo Scrapeas Una Vez English | 中文 | 日本語 | 한국어 | Русский | Türkçe | Deutsch | Español | français | Português |...

httpx-action

httpx Action makes it easy to orchestrate httpx with GitHub Action. Example Usage GitHub Action running httpx on list of hosts root@kitploit: - name: 💥 httpx - HTTP Web Server probing uses: projectdiscovery/httpx-action@main with: list: hosts.txt Example workflow : .github/workflows/httpx.yml...

vimana-framework

概述 Vimana 是一个模块化安全框架，用于审计 Python API 和 Web 应用程序。其基于插件的架构使安全专业人员能够通过自动和手动技术评估、模糊测试和分析 Python 项目。 核心功能： 漏洞检测与利用 静态与动态分析 应用程序爬取与发现 持久化与后渗透分析 CI/CD 安全集成 研究与开发（R&D） 📋 文档 安装指南 - 设置说明和部署选项 用户指南 - 完整使用指南和命令参考 CI/CD 集成 - GitHub Actions、GitLab CI/CD、CircleCI、Jenkins 的流水线模板...

vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

duckLogger

DuckLogger DuckLogger is an ESP32-S3–based USB Key Logger. It logs keystrokes in a text file, and provides wireless access to download logs through a built-in Wi-Fi access point. Recreating this project doesn't require any custom PCB. Hardware used here is less than $10 in total on places like...

PhoenixC2

PhoenixC2 An Open-Source C2-Framework written in pure Python3. Disclaimer This project is still in development and not ready for professional use. The author and its affiliates do not endorse or condone any illegal or malicious activity conducted with this framework. Users of this framework are...

webpwn3r

webpwn3r Este proyecto no ha sido mantenido durante años, y fue escrito cuando empecé a aprender Python, pero aun así a la gente le gusta :D. solo soporta python2.7 WebPwn3r - Escáner de seguridad de aplicaciones web. Por Ebrahim Hegazy - @Zigoo0 Agradecimientos: @lnxg33k, @dia2diab @Aelhemily,...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

LFI-FINDER

🍀 LFI FINDER TOOL 🍀 Written by TMRSWRR Version 1.0.0 Instagram: TMRSWRR 📹 How to use 📹 Click on the image... LFI-FINDER is an open-source tool available on GitHub that focuses on detecting Local File Inclusion LFI vulnerabilities. Local File Inclusion is a common security vulnerability that allow...

domain-to-webapp

domain-to-webapp A simple bash script for finding web application hosted within a domain Requirements curl Subfinder docker image Usage root@kitploit: $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' ...

2018-QWB-CTF

2018-QWB-CTF 2018 Qiangwang Cup CTFRecopilación de retos root@kitploit: │ ├── 01Misc-4题 │ ├── 题目名称：ai-nimals │ │ └── 题目名称：ai-nimals.mhtml │ ├── 题目名称：welcome │ │ └── 题目名称：welcome.mhtml │ ├── 题目名称：签到 │ │ └── 题目名称：签到.mhtml │ └── 题目名称：问卷调查 │ └── 题目名称：问卷调查.mhtml ├── 02Crypto-5题 │ ...

ravage

Ravage Ravage is an evidence-first CLI for assessing a running web application that you own or are explicitly authorized to test. It combines deterministic reconnaissance and validation with an optional model-driven attack loop, while keeping scope, authentication, traffic accounting, and evidenc...

TIWAP

Totally Insecure Web Application Project TIWAP TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities The application is...

commix

Commix short for command injection exploiter is an open source penetration testing tool, written by Anastasios Stasinopoulos @ancst, that automates the detection and exploitation of command injection vulnerabilities. You can visit the collection of screenshots demonstrating some of the features o...