A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Repository Index
47,133 repositories indexed
1–24 of 26 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Automated Penetration Testing Agentic Framework Powered by Large Language Models
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Web path scanner
🐶 A curated list of Web Security materials and resources.
Infection Monkey - An open-source adversary emulation platform
An all-in-one hacking tool to remotely take over Android devices.
Automated NoSQL database enumeration and web application exploitation tool.
Automated Security Testing For REST API's
Security Tool to Look For Interesting Files in S3 Buckets
Bloodhound Reporting for Blue and Purple Teams
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
Hacking Toolkit
Security Auditor Utility for GraphQL APIs
Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
Mock an SSH server and define all commands it supports (Python, Twisted)
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
Open-source agentic security operations platform:
brute force SSH public-key authentication