#1Tools for testing, exploiting, and securing web applications and APIs.
Kitploit recommended
mitchellkrogza/nginx-ultimate-bad-bot-blockerNginx Block Bad Bots, Spam Referrer Blocker, Vulnerability Scanners, User-Agents, Malware, Adware, Ransomware, Malicious Sites, with anti-DDOS,…
frohoff/ysoserialA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
ffffffff0x/1earnffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup
yogeshojha/renginereNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines,…
interceptsuite/proxybridgeForce Proxy to any Windows/MacOS/Linux Application TCP and UDP traffic
asciimoo/wuzzInteractive cli tool for HTTP inspection
lirantal/awesome-nodejs-securityCurated directory of Node.js security tools, static analyzers, vulnerability scanners, and educational resources covering OWASP Top 10, supply chain…
owasp/asvsApplication Security Verification Standard
0dayctf/reverse-shell-generatorHosted Reverse Shell generator with a ton of functionality. -- (Great for CTFs)
gh05tcrew/pentestagentAI agent framework for black-box security testing with autonomous multi-agent orchestration, built-in pentesting tools, and MCP integration for bug…
lc/gauFetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
ljagiello/ctf-skillsAgent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
hahwul/dalfoxFast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via…
pomerium/pomeriumIdentity-aware reverse proxy that delivers zero-trust access to internal apps and services via context-aware policy, continuous verification, and no…
swisskyrepo/ssrfmapAutomatic SSRF fuzzer and exploitation tool
elementalsouls/claude-bughunterA Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24…
zan8in/afrogA Security Tool for Bug Bounty, Pentest and Red Teaming.
trustedsec/unicornUnicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell…
