#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
qax-a-team/cobaltstrike-toolsetAggressor Script, Kits, Malleable C2 Profiles, External C2 and so on
hackerhouse-opensource/exploitsexploits and proof-of-concept vulnerability demonstration files from the team at Hacker House
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
mandatoryprogrammer/sonar.jsA framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration combined with WebSockets and…
wyatu/cve-2018-20250exp for https://research.checkpoint.com/extracting-code-execution-from-winrar
harsh-bothra/securityexplainedSecurityExplained is a new series after the previous learning challenge series #Learn365. The aim of #SecurityExplained series is to create…
lightos/panopticPanoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files…
ktecv2000/proxyshellProof-of-concept exploit for Microsoft Exchange Server Remote Code Execution via ACL bypass, privilege escalation, and arbitrary file write…
star-sg/cveA collection of proof-of-concept exploit scripts written by the STAR Labs team for various CVEs that they discovered or found by others.
papamica/waf-checkerTests your WAF with +160 payloads
arno0x/embedinhtmlEmbed and hide any file in an HTML file
d4vinci/pyflooderA http flood python script that could stop a normal website in 10s
horizon3ai/vcenter_saml_loginA tool to extract the IdP cert from vCenter backups and log in as Administrator
rizemon/exploit-writing-for-osweTips on how to write exploit scripts (faster!)
brannondorsey/dns-rebind-toolkitA front-end JavaScript toolkit for creating DNS rebinding attacks.
waf-bypass-maker/waf-community-bypassesCurated CSV collection of community-sourced Web Application Firewall bypass payloads for testing and validating WAF protections.
ns-sp4ce/cve-2021-21972CVE-2021-21972 Exploit
edr4/xss-bypass-filtersCurated XSS payload collection and filter-bypass cheat sheet: WAF-specific evasion, JS/HTML injection vectors, encoding tricks, DOMPurify and…
