A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Repository Index
47,133 repositories indexed
1–24 of 43 · Most stars
A platform for building proxies to bypass network restrictions.
A platform for building proxies to bypass network restrictions.
A proxy tool to bypass GFW.
Stealth Chromium that passes every bot detection test. Drop-in Playwright replacement with source-level fingerprint patches. 50+ tests passed.
An unidentifiable mechanism that helps you bypass GFW.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
DPI bypass multi platform
Proxy server to bypass Cloudflare protection
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
📊 APIs for Web Scraping, Browser Automation, and E2E Testing. CDP Mode bypasses bot-detection and handles CAPTCHAs. Adds stealth to Playwright. Includes an MCP server.
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)
Stealth headless browser for AI agents — bypass Cloudflare, bot detection, and anti-scraping. Drop-in Puppeteer/Playwright replacement.
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
Automated CAPTCHA solver for your browser. Works with Selenium, Puppeteer, Playwright, and more.
Universal MCT wrapper script for all Windows 10/11 versions from 1507 to 21H2!
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
A Python module to bypass Cloudflare's anti-bot page.
Playwright that anti-bots cannot see, so no captchas: same API, anti-detect stealth headless Firefox, undetected fingerprint, bypass bot detection, Python web scraping and browser automation.
Web-extension for bypassing censorship in Russia
SURF - Advanced Go HTTP client with Chrome/Firefox browser impersonation, HTTP/3 with QUIC fingerprinting, JA3/JA4 TLS emulation, and anti-bot bypass for web automation and scraping.
A big list of Android Hackerone disclosed reports and other resources.
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.