#1Tools for testing, exploiting, and securing web applications and APIs.
Kitploit recommended
malwareman007/scanner-and-patcherA Web Vulnerability Scanner and Patcher
xcanwin/cve-2024-4577-php-rce[漏洞复现] 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。
jas502n/cve-2019-11580Python exploit for CVE-2019-11580, a remote code execution vulnerability in Atlassian Crowd and Crowd Data Center. Uploads a malicious plugin to…
d4vinci/bugz-toolsA collection of tools I wrote for bug bounty or hacking and don't mind publishing it :smile:
umutcamliyurt/subhunterFast subdomain takeover scanner that checks DNS CNAME records against known fingerprints to detect vulnerable subdomains. Built in Go with…
xcanwin/cve-2023-4357-chrome-xxe[漏洞复现] 全球首款单文件利用 CVE-2023-4357 Chrome XXE 漏洞 EXP, 实现对访客者本地文件窃取. Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitors.
nccgroup/carnivoreTool for assessing on-premises Microsoft servers authentication such as ADFS, Skype, Exchange, and RDWeb
mpgn/rails-doubletap-rceRCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)
tpt11fb/attacktomcatTomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含
nu11secur1ty/cve-nu11secur1tyCurated repository of CVE records with CVSS scoring, providing a structured reference for vulnerability analysis, exploitation research, and security…
kira2040k/php_code_analysisStatic PHP code scanner that detects SQL injection, XSS, SSRF, LFI, command injection, insecure deserialization, and other web vulnerabilities in…
w01fh4cker/cve-2024-27198-rceCVE-2024-27198 & CVE-2024-27199 Authentication Bypass --> RCE in JetBrains TeamCity Pre-2023.11.4
nccgroup/outlookleaktestThe Outlook HTML Leak Test Project
lunasec-io/spring4shell-pocThis is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).
impact-i/x8-burpHidden parameters discovery suite
m14r41/scan4secretsFind credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF,…
dariusztytko/token-reverserWords list generator to crack security tokens
nodauf/swegoSwiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features
