A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Repository Index
47,133 repositories indexed
1–24 of 37 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
The authentication glue you need.
Web path scanner
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
🐶 A curated list of Web Security materials and resources.
Scapy: the Python-based interactive packet manipulation program & library.
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Malicious traffic detection system
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
Securely and anonymously share files, host websites, and chat with friends using the Tor network
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
Dark Web OSINT Tool
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
Modern, privacy-friendly, and detailed web analytics that works without cookies or JS.
Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function
Automated Security Testing For REST API's
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
What's in your data? Extract schema, statistics and entities from datasets
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
An information security preparedness tool to do adversarial simulation.
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.