social-engineer-toolkit

The Social-Engineer Toolkit SET The Social-Engineer Toolkit is an open-source penetration testing framework for authorized social-engineering assessments. SET provides guided attack vectors for security teams that need to test user awareness, validate controls, and run consent-based red-team...

Garud

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. I made this tool to automate my recon and save my time. It really give me headache always type such command and then wait to complete one command and I type oth...

JWTXposer

JWTXposer Automated JWT Discovery & Analysis Tool for Bug Bounty Hunters and Red Teamers What Is JWTXposer? JWTXposer is an automated reconnaissance tool that scans public archives like the Wayback Machine , extracts leaked JWT tokens , and decodes them to identify potentially exploitable...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

awesome-web-hacking

awesome-web-hacking This list is for anyone wishing to learn about web application security but do not have a starting point. You can help by sending Pull Requests to add more information. If you're not inclined to make PRs you can tweet me at @infoslack Table of Contents Books Documentation Tool...

Injectus

Injectus Simple python tool that goes through a list of URLs trying CRLF and open redirect payloads. ▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ · ██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀. ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄ ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█ ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀...

dora

dora Features Blazing fast as we are using ripgrep in backend Exploit/PoC steps for many of the API key, allowing to write a good report for bug bounty hunting Unlike many other API key finders, dora also shows the path to the file and the line with context for easier analysis Can easily be...

vulnrepro-benchmark

VulnRepro A benchmark that checks if an AI model can actually review vulnerable code, or if it just sounds confident. Most security benchmarks ask one question: can the model find the bug? That is only half the job. The other half, the part that actually wears you down in real review work, is not...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

web-hacking-playground

Web Hacking Playground Description Web Hacking Playground is a controlled web hacking environment. It consists of vulnerabilities found in real cases, both in pentests and in Bug Bounty programs. The objective is that users can practice with them, and learn to detect and exploit them. Other topic...

Claude-BugHunter

claude-bughunter A self-contained Claude skill bundle for bug hunting and external red-team work · 83 skills · 15 slash commands · 681 disclosed-report patterns 433 now individually cited & auditable across 24 core vulnerability classes · enterprise identity + infrastructure attack matrices ·...

flumberboozle

flumberboozle Suite of programs meant to aid in bug hunting and security assessments Why this weird name? Just because I heard it first here so I thought this meaningless word would be fitting name of a repository I don't know what I'm going to do with. Contents This repository contains scripts...

s3sec

s3sec Test AWS S3 buckets for read/write/delete access This tool was developed to quickly test a list of s3 buckets for public read, write and delete access for the purposes of penetration testing on bug bounty programs. Screenshot Found a bug bounty using this tool? Feel free to add me as a...

Bug_Bounty_writeups

STOP DOING BEG-BOUNTIES - STOP COPYING ANOTHERS POC ! DO SOMETHING DIFFERENT!🔴🔴🔴🔴✔ Want to support my work? DONT TRY HACKING WITHOUT BASICS --- IT WILL BE DANGEROUS FOR YOU AND YOUR FUTURE! Contents Cross Site Scripting XSS Cross Site Request Forgery CSRF Clickjacking UI Redressing Attack Local...

huntr-com-bug-bounties-collector

huntr.com bugs collector New bug bountyvulnerabilities collector Requirements Chrome with GUI If you encounter trouble with script execution, check the status of VMs GPU features, if available. Chrome WebDriver Preview python3 main.py 2024-02-20 16:14:47.836189 1. Arbitrary File Reading due to La...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

ai-exploits

AI Exploits The AI world has a security problem and it's not just in the inputs given to LLMs such as ChatGPT. Based on research done by Protect AI and independent security experts on the Huntr Bug Bounty Platform, there are far more impactful and practical attacks against the tools, libraries an...

gerobug

Gerobug: The First Open Source Bug Bounty Platform. Gerobug The first open source self-managed bug bounty platform. Are you a company, planning to have your own bug bounty program, with minimum budget? WE GOT YOU! We are aware that some organizations have had difficulty establishing their own bug...