A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Web path scanner
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Low code web framework for real world applications, in Python and Javascript
Dark Web OSINT Tool
w3af: web application attack and audit framework, the open source web vulnerability scanner.
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
Scirius is a web application for Suricata ruleset management and threat hunting.
A Collection of Vulnerabilities in ERC20 Smart Contracts With Tokens Affected
honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
Open Source SIEM (Security Information and Event Management system).
Framework agnostic set of sqlalchemy classes that make building applications that require permissions an easy task.
Runtime guardrails for Claude Code. Auto-approve what's safe, gate what's risky, block what's dangerous. Dual enforcement, full audit trail. MIT.
Yosai integration with the Pyramid Web Framework