A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- pentest
- payload
- bypass
- web-application
Repository Index
47,133 repositories indexed
1–24 of 24 · Most stars
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
the LLM vulnerability scanner
- ai
- llm-evaluation
- llm-security
- security-scanners
Trail of Bits skills for security research, vulnerability detection, and audit workflows
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
w3af: web application attack and audit framework, the open source web vulnerability scanner.
A high performance offensive security tool for reconnaissance and vulnerability scanning
- reconnaissance
- scanner
- vulnerability-assessment
- vulnerability-scanner
Create randomly insecure VMs
- security
- security-vulnerability
- virtualization
- randomization
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
A modular vulnerability scanner with automatic report generation capabilities.
- artemis
- pentesting
- security
- security-scanner
AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.
- ai
- attack-surface-management
- bbot
- cybersecurity
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
- cve-2026-109618
- cve-2026-109619
- exploit
- mod-php
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
- ai-agents
- attack-surface-management
- docker
- penetration-testing
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
- crtsh
- cve
- cve-2026-109618
- cve-2026-109619
A honeypot for the Log4Shell vulnerability (CVE-2021-44228).
WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. This is a Remote Code Execution vulnerability.
- security
- security-tools
- honeypot
- deception
A plugin based GraphQL vulnerability assessment tool.
- graphql
- graphql-security
- pentest-tool
- python3
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code