jonathanwilbur/cve-2018-19131Proof-of-concept exploit demonstrating cross-site scripting (XSS) in Squid Proxy 3.5.27 via malicious X.509 certificate commonName field, with Docker…
sullo/niktoPerl-based web server scanner that performs comprehensive vulnerability checks, CGI scanning, and server fingerprinting with customizable plugins and…
s0md3v/xsstrikeAdvanced XSS detection suite with context-aware payload generation, multi-threaded crawling, WAF evasion, and DOM scanning for automated web security…
owasp/dvsaa Damn Vulnerable Serverless Application
redteamsocietegenerale/dllirantAutomates DLL hijacking and DLL proxying research on Windows binaries by analyzing PE imports, generating proxy DLLs, and producing proof-of-concept…
appsecco/dvcsharp-apiDeliberately vulnerable C# API application for practicing web application security testing, exploitation techniques, and vulnerability analysis in a…
dobin/burpsentinelGUI Burp Plugin to ease discovering of security holes in web applications
portswigger/pentest-mapperA Burp Suite Extension for Application Penetration Testing to map flows and vulnerabilities
go-appsec/toolboxCollaborative application security testing between humans and agents via CLI and MCP
raz0r/burp-radamsaBurp Suite extension integrating the Radamsa fuzzer for automated input mutation and vulnerability discovery during web application penetration…
projectdiscovery/collaboratorGo library for deploying BurpSuite Collaborator instances, enabling blind out-of-band vulnerability detection and interaction tracking during web…
theronielanddaronpodcastshow/svjaApache Struts application intentionally packed with realistic, complex vulnerabilities for security training and penetration testing practice,…
halkichi0308/cve-2015-9251Proof-of-concept exploit for CVE-2015-9251, demonstrating a specific web application vulnerability with minimal code for testing and verification.
theopaid/cve-2026-67181-http-request-smuggling-via-transfer-encoding-desynchronization-rouille-Security advisory and PoC for HTTP request smuggling (CVE-2026-67181) due to Transfer-Encoding desynchronization in rouille's proxy module.
george0papasotiriou/cve-2026-11114-node.js-vm-sandbox-escape-via-proxyPoC exploit for CVE-2026-11114 demonstrating Node.js vm sandbox escape via Proxy to achieve remote code execution against a vulnerable HTTP /eval…
george0papasotiriou/cve-2026-11101-http-cache-poisoning-via-unkeyed-query-parameterExploit web cache poisoning via unkeyed query parameters to persist malicious JavaScript responses; includes a vulnerable Flask cache server and PoC…
melroyb/cve-2019-14319Proof-of-concept exploit for CVE-2019-14319, demonstrating a specific vulnerability in a web application for security testing and verification.
zetc0de/wonderpluginFake WonderCMS plugin containing a backdoor web shell for exploiting authenticated remote code execution and blind SSRF vulnerabilities.
