#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
mozilla/firefox-devtools-mcpModel Context Protocol server for Firefox DevTools - enables AI assistants to inspect and control Firefox browser through WebDriver BiDi
nccgroup/shockerA tool to find and exploit servers vulnerable to Shellshock
1n3/wordpress-xmlrpc-brute-force-exploitWordpress XMLRPC System Multicall Brute Force Exploit (0day) by 1N3 @ CrowdShield
bhdresh/cve-2017-0199Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test…
orangetw/awesome-jenkins-rce-2019There is no pre-auth RCE in Jenkins since May 2017, but this is the one!
silentchainai/silentchainAI-powered vulnerability scanner extension for Burp Suite with multi-provider support (Ollama, OpenAI, Claude, Gemini)
trustedsec/cve-2019-19781This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.
kmkz/exploitsOriginal CVEs, exploit PoCs, and security advisories with detailed vulnerability chains, privilege escalation, and container escape techniques for…
payatu/tiredful-apiAn intentionally designed broken web application based on REST API.
mazen160/firefox-security-toolkitA tool that transforms Firefox browsers into a penetration testing suite
devcop95/bugbounty-lab101A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates,…
0xmr007/lab4purplesecLab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense +…
federicodotta/java-deserialization-scannerAll-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities
dlegs/php-jpeg-injectorInjects PHP payloads into JPEG images for web application exploitation, bypassing GD library image processing to achieve remote code execution.
s0md3v/jshellJShell - Get a JavaScript shell with XSS.
praetorian-inc/chromealoneA tool to transform Chromium browsers into a C2 Implant
zigoo0/webpwn3rWebPwn3r - Web Applications Security Scanner.
hatriot/clusterdapplication server attack toolkit
