A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Repository Index
47,133 repositories indexed
1–24 of 31 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Automated Penetration Testing Agentic Framework Powered by Large Language Models
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Web path scanner
🐶 A curated list of Web Security materials and resources.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
fsociety Hacking Tools Pack – A Penetration Testing Framework
Infection Monkey - An open-source adversary emulation platform
An all-in-one hacking tool to remotely take over Android devices.
Automated NoSQL database enumeration and web application exploitation tool.
Automated Security Testing For REST API's
The Offensive Manual Web Application Penetration Testing Framework.
Security Tool to Look For Interesting Files in S3 Buckets
Bloodhound Reporting for Blue and Purple Teams
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
Hacking Toolkit
Security Auditor Utility for GraphQL APIs
MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.
Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.