A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- pentest
- payload
- bypass
- web-application
Repository Index
47,133 repositories indexed
1–24 of 37 · Most stars
Awesome Privacy - A curated list of services and alternatives that respect your privacy because PRIVACY MATTERS.
Web path scanner
🐶 A curated list of Web Security materials and resources.
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
an awesome list of honeypot resources
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
Rated, auto-refreshed list of decompiled, recompiled & reverse-engineered games: decomps, static recomps, source ports, engine remakes, browser ports.
- awesome
- awesome-list
- decompilation
- game-preservation
A curated list of resources related to Industrial Control System (ICS) security.
- hacktoberfest
- ics
- iiot
- security
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
- awesome-list
- binary-analysis
- ghidra
- malware-analysis
A collection of fascinating and bizarre Censys Search Queries
- censys
- dorks
- queries
- search
Don't reverse engineer it twice. 17,000+ open-source tools built by reverse engineering closed apps, APIs, devices, protocols, file formats, games and AI tools. Search site + agent skill + MCP server, refreshed nightly.
Generate smart and powerful wordlists
- wordlist
- password
- hacking-tool
- password-cracking
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
A curated list of awesome Fuzzing(or Fuzz Testing) for software security
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
- elliot
- cupp
- passwords
- hacking-tool
Awesome Reverse Engineering Anything: tools, projects, case studies and research papers for websites, games, apps, binaries, firmware and communication protocols.
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
A Collection of Vulnerabilities in ERC20 Smart Contracts With Tokens Affected
- smart-contracts
- erc20-tokens
- vulnerabilities
- solidity
Raspberry PI-TIMOLO ( PI-TImelapse, MOtion, LOwLight ) uses RPI picamera and OpenCV for Remote Headless Security Monitoring using Motion Tracking, Rclone Auto Sync files with remote storage services. Auto Twilight Transitions and Low Light Camera Settings. Panoramic images using PanTiltHat and More. This project is featured on GitHub Awesome software.
- opencv
- pi-camera
- python
- lowlight
Awesome list of AI reverse engineering and rebuilds: what AI agents took apart and recreated, and which ones really used REA (Reverse Engineer Anything).
A curated collection of REA and AI-assisted reverse engineering cases, projects, and ideas. Updated every four hours.
A curated list of AI-assisted reverse engineering: decompilation, recompilation and native ports, with how each project verifies correctness