A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- pentest
- payload
- bypass
- web-application
Repository Index
59,621 visible repositories in the index
1–24 of 61 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
- agent-security
- agent-skills
- agentic-ai
- ai-security
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
the LLM vulnerability scanner
- ai
- llm-evaluation
- llm-security
- security-scanners
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Trail of Bits skills for security research, vulnerability detection, and audit workflows
A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
TranslatedDeepAudit: An AI hacker team for everyone, putting vulnerability discovery within reach. Beginners can deploy and run it with one click, with autonomous collaborative auditing + automated sandbox PoC verification. Supports private deployment with Ollama and one-click report generation. Supports relay stations. Making security no longer expensive and auditing no longer complicated.
- ai
- bug-detection
- code-audit
- code-quality
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
- devops
- penetration-testing
- vulnerability
- vulnerability-scanners
Bjorn is a powerful network scanning and offensive security tool for the Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers network targets, identifies open ports, exposed services, and potential vulnerabilities. Bjorn can perform brute force attacks, file stealing, host zombification, and supports custom attack scripts.
- automated-pentesting
- bruteforce
- cybersecurity
- e-paper
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
AI-powered bug bounty hunting toolkit that works with or without subscription.
- ai-security
- bug-bounty
- bugcrowd
- claude-ai
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
- python
- penetration-testing
- penetration-testing-framework
- owasp
Scalable fuzzing infrastructure.
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
- ai-security
- anthropic
- application-security
- bug-bounty
Open-Source Unified Vulnerability Management, DevSecOps & ASPM
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.
Hunt for security weaknesses in Kubernetes clusters
- vulnerabilities
- kubernetes-clusters
- hacktoberfest
w3af: web application attack and audit framework, the open source web vulnerability scanner.
the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.
- decompiler
- vulnerability-scanners
- malware-analysis
- security-audit
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
- weblogic
- tomcat
- exploit
- poc
Mythril is a symbolic-execution-based securty analysis tool for EVM bytecode. It detects security vulnerabilities in smart contracts built for Ethereum and other EVM-compatible blockchains.
- security-analysis
- ethereum
- blockchain
- smart-contracts