wfuzz

Wfuzz - Webファザー Wfuzzは、Webアプリケーションの評価作業を容易にするために作成されました。その基本概念は単純で、FUZZキーワードへの参照を、指定されたペイロードの値で置き換えるというものです。 Wfuzzにおけるペイロードはデータのソースです。 このシンプルな概念により、HTTPリクエストの任意のフィールドに任意の入力を注入でき、パラメータ、認証、フォーム、ディレクトリ/ファイル、ヘッダーなど、さまざまなWebアプリケーションコンポーネントに対して複雑なWebセキュリティ攻撃を実行できます。 Wfuzzは単なるWebコンテンツスキャナではありません：...

inter-recon

inter-recon Script to perform automatic initial web and vulnerability recon. It has some checks in case of errors. There is a possibility to skip some checks, to restart them and/or to continue with the last point you stopped. This is because sometimes there are network issues like time limit on...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

h1-ctf: Hacky Holidays CTF Writeup

Intro: 12 days of challenges - some more challenging than others! This holiday CTF had all 12 challenges hosted on the website https://hackyholidays.h1ctf.com/ F1129112 Challenge 1: I started by significantly overthinking all of the early challenges in this competition. When this CTF started the...

Stripo Inc: Authorization for wp-admin directory are vulnerable to brute force.

The domain https://my.stripo.email in the directory /wp-admin are not blocking amount of request in the authorization form, this leads to bruteforce attack. Where the attacker are able to guess tons of passwords without getting blocked or the password field gets locked. This attack make it possib...

Automatically Brute Force All Services – BruteX

Automatically brute force all services Including: Open ports DNS domains Web files Web directories Usernames Passwords Dependencies: NMap Hydra Wfuzz SNMPWalk DNSDict Download: git clone https://github.com/1N3/BruteX.git Usage: ./brutex target To brute force multiple hosts, use brutex-massscan an...

Wfuzz - The Web Application Bruteforcer

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked directories, servlets, scripts, etc, bruteforce GET and POST parameters for checking different kind of injections SQL, XSS, LDAP,etc, bruteforce Forms parameters User/Password, Fuzzing,etc...

BruteX - Automatically Brute Force all Services Running on a Target

Automatically brute force all services running on a target including: Open ports DNS domains Web files Web directories Usernames Passwords USAGE ./brutex target DEPENDENCIES NMap Hydra Wfuzz SNMPWalk DNSDict To brute force multiple hosts, use brutex-massscan and include the IP's/hostnames to scan...

Penetration Testing Browser Bundle: PenQ

PenQ is an open source, Linux-based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. Penetration Testin...