waybackurls

waybackurls 从标准输入接受以换行符分隔的域名，从 Wayback Machine 获取 .domain 的已知 URL，并输出到标准输出。 使用示例： root@kitploit: ▶ cat domains.txt | waybackurls urls 安装： root@kitploit: ▶ go install github.com/tomnomnom/waybackurls@latest 致谢 本工具受 @mhmdiaa 的 waybackurls.py 脚本启发。 感谢他/她提供的绝妙创意！...

pentest-tools

pentest-tools A collection of custom security tools for quick needs. Important note ‼ A big clean occured in 2022-11 ‼ Some useless/not working scripts have been archived and some others have been moved to their own repository to get more visibility, feel free to check them: apk-analyzer...

sqlifinder

用Python编写的SQL注入扫描器。 功能特性 • 安装 • 使用方法 • sqlifinder 是一个用于检测基于GET的SQL注入漏洞的工具，利用waybackurls、网络爬虫和SQL注入payload进行检测。 功能特性 快速且强大的扫描器 包含网络爬虫和waybackurls 使用方法 root@kitploit: python3 sqlifinder.py -h 这将显示工具的帮助信息。以下是其支持的所有选项。 安装 Sqlifinder 要求： python3 huepy requests tqdm 运行以下命令进行安装： root@kitploit: ▶ sudo ap...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

One-Liner-Collections

Colección de One-Liners Este repositorio contiene una lista de One-Liners con descripciones y requisitos de instalación ──────────────────────────────────────────────────────────────────────── Inyección SQL Requisitos de Instalación 1. Subfinder : https://github.com/projectdiscovery/subfinder 2...

xss-security-scanner

XSS Security Scanner A professional web-based XSS vulnerabili...

EndExt - Go Tool For Extracting All The Possible Endpoints From The JS Files

EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look for all t...

Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. Requirements: Go Language, Python 2.7 or Python 3. System requirements: Recommended to run on vps with 1VCPU and 2GB ram. Tools used - You must need to install...

meg+ - Automated Reconnaissance Wrapper

This wrapper will automate numerous tasks and help you during your reconnaissance process. The script finds common issues, low hanging fruit, and assists you when approaching a target. meg+ also allows you to scan all your in-scope targets on HackerOne in one go — it simply retrieves them using a...