A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- pentest
- payload
- bypass
- web-application
Repository Index
47,133 repositories indexed
1–24 of 37 · Most stars
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
- application-firewall
- firewall
- linux
- networking
[MLsys2026 Best Paper]: https://arxiv.org/abs/2506.08276. RAG on Everything with LEANN. Enjoy 97% storage savings while running a fast, accurate, and 100% private RAG application on your personal device.
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Low code web framework for real world applications, in Python and Javascript
- frappe
- erpnext
- python
- javascript
ValueCell is a community-driven, multi-agent platform for financial applications.
- agentic-ai
- agents
- ai
- assitant
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/
Web application fuzzer
Reverse engineering and pentesting for Android applications
- android
- dalvik
- reverse-engineering
- dex
w3af: web application attack and audit framework, the open source web vulnerability scanner.
Tool to look for several security related Android application vulnerabilities
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
Django Simple Captcha is an extremely simple, yet highly customizable Django application to add captcha images to any Django form.
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
- security-audit
- penetration-testing
- penetration-test
- virtual-hosts
SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
- sip
- voip
- password-cracker
- svwar
Simple yet powerful authorization / authentication client library for Python web applications.
- python
- authentication
- oauth2-client
- oauth-client
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
Scirius is a web application for Suricata ruleset management and threat hunting.
- python
- security
- management
- interface
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Web Application Honeypot
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling