wstg

OWASP Web Security Testing Guide Welcome to the official repository for the Open Worldwide Application Security Project® OWASP® Web Security Testing Guide WSTG. The WSTG is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of...

macnoise

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

Damn-Vulnerable-GraphQL-Application

Damn Vulnerable GraphQL Application Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. Table of Contents About DVGA Operation Modes Scenarios Prerequisites Installation Installation - Docker...

Payload-and-Polyglot-Lists

Payload & Polyglot Lists Found a payload that doesn't work? Please open an issue with the payload, target context, and what you expected to happen. Pull requests with fixes or new payloads are always welcome. Research is ongoing. This project is under active development and will be updated...

VECTR

VECTR documentation: https://docs.vectr.io VECTR Community Discord Channel: https://discord.gg/2FRd8zf728 VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios. VECTR provides the...

MalQR.github.io

MalQR About MalQR is a collection of malicious QR codes and barcodes you can use to test the security of your scanners. It gives you the ability to conduct such tests with easiness : you just need to have a smartphone, a tablet or a laptop with an internet connection and browse MalQR.shielder.com...

PhantomCrawler

.png PhantomCrawler is a security testing and research tool that simulates website interactions from different proxy IP addresses to analyze how websites behave under varied network and geolocation conditions. Features: Utilizes a list of proxy IP addresses from a specified file. Supports both HT...

androwarn

Androwarn Yet another static code analyzer for malicious Android applications Description Androwarn is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. The detection is performed with the static analysis of the...

dep-scan

Introduction OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM...

PassMute

PassMute - A Password Trasmutation/Mutator tool This is a command-line tool written in Python that applies one or more transmutation rules to a given password or a list of passwords read from one or more files. The tool can be used to generate transformed passwords for security testing or researc...

jwtear

Jwtear A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible...

PolarDNS

PolarDNS is a specialized authoritative DNS server written in Python 3.x, originally developed as a tool for security testing of DNS recursive resolvers from the server-side. It allows the operator to produce custom DNS responses, making it suitable for in-depth DNS protocol testing purposes...

ajpfuzzer

AJPFuzzer - A command-line fuzzer for AJPv1.3 AJPFuzzer is a rudimental fuzzer for the Apache JServ Protocol ajp13. Built on top of libajp13, the tool allows you to create and send AJP messages using an easy-to-use command line interface. AJPFuzzer can craft properly formatted AJP13 messages all...

apk-medit

apk-medit Apk-medit is a memory search and patch tool for debuggable apk without root & ndk. It was created for mobile game security testing. Many mobile games have rooting detection, but apk-medit does not require root privileges, so memory modification can be done without bypassing the rooting...

mastg

OWASP Mobile Application Security Testing Guide MASTG The OWASP Mobile Application Security Testing Guide MASTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration MASWE...

drozer

drozer drozer is a security testing framework for Android. drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Android Runtime, other apps' IPC endpoints and the underlying OS. drozer provides tools to help you use,...

cdf

CDF – crypto differential fuzzing CDF is a tool to automatically test the correctness and security of cryptographic software. CDF can detect implementation errors, compliance failures, side-channel leaks, and so on. CDF implements a combination of unit tests with "differential fuzzing", an approa...

jaeles

!IMPORTANT This repository has been archived and is no longer maintained. Check out github.com/vigolium/vigolium — a brand new scanner that I made that's better in every way. Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner...

MemShellParty

MemShellParty 中文 | English !WARNING This tool is intended only for security researchers, network administrators, and related technical personnel for authorized security testing, vulnerability assessment, and security auditing. Using this tool for any unauthorized network attack or penetration tes...