A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- pentest
- payload
- bypass
- web-application
Repository Index
47,133 repositories indexed
1–13 of 13 · Most stars
A proxy tool to bypass GFW.
Stealth Chromium that passes every bot detection test. Drop-in Playwright replacement with source-level fingerprint patches. 50+ tests passed.
- anti-detect
- bot-detection
- browser-automation
- chromium
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
Proxy server to bypass Cloudflare protection
- puppeteer
- cloudflare
- proxy
- chrome
📊 APIs for Web Scraping, Browser Automation, and E2E Testing. CDP Mode bypasses bot-detection and handles CAPTCHAs. Adds stealth to Playwright. Includes an MCP server.
- python
- selenium-python
- e2e-testing
- seleniumbase
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)
A Python module to bypass Cloudflare's anti-bot page.
- cloudflare
- anti-bot-page
- protected-page
- scrape
Playwright that anti-bots cannot see, so no captchas: same API, anti-detect stealth headless Firefox, undetected fingerprint, bypass bot detection, Python web scraping and browser automation.
- datadome
- perimeterx
- akamai
- antidetect-browser
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.
- anti-detect
- antidetect-browser
- automation
- browser
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
Security linter for AI-generated code: catches the exact vulnerabilities Copilot, Cursor and ChatGPT repeatedly produce. SQL injection, hardcoded secrets, JWT bypass, command injection and 15+ more rules. Grade A–F. Zero config. CI/CD ready.