Tools

tanprathan/mobileapp-pentest-cheatsheet

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration…

syhunt/sandcat

An open-source, pentest and developer-oriented web browser, using the power of Lua

synlace/ferret

The collaborative web app pentest suite

welfordian/mitm-proxy

Go-based MITM HTTP/HTTPS proxy for intercepting, inspecting, and replaying traffic. Features admin dashboard, AI copilot, threat scanning, caching,…

matrixleons/evilwaf

Authorized WAF bypass proxy that rotates TCP/TLS/HTTP2 fingerprints, hunts origin IPs behind firewalls, and scans WAF defenses across 10 layers for…

infobyte/evilgrade

Modular framework for injecting fake software updates via DNS spoofing and MITM attacks. Includes built-in DNS and web servers, 60+ pre-configured…

yeswehack/pwnfox

Firefox/Burp extension for security audits with single-click proxy, container profiles, postMessage logging, JS injection toolbox, and security…

joanbono/gurp

Go-based CLI client for BurpSuite REST API, enabling automated scanning, proxy control, and task management for penetration testing workflows.

johndoe31415/ratched

Transparent Man-in-the-Middle TLS proxy for penetration testing. Intercepts TLS connections based on SNI, dumps traffic to PCAPNG, and supports…

larrypeseckis/burp-cc-bridge

REST API automation for Burp Suite Community Edition. Drop-in Java extension exposing send/repeat/history endpoints over a local HTTP API.

ssh-mitm/ssh-mitm

Man-in-the-middle SSH proxy for security audits and penetration testing. Intercepts SSH, SCP, and SFTP sessions with support for agent and port…

jas502n/burpsuite-plugin

JavaScript-based BurpSuite plugin for web application pentesting, providing custom scanning, exploitation, and analysis modules.

yaklang/yakit

All-in-one penetration testing platform with MITM proxy, web fuzzer, reverse connection handler, and plugin system for automated security testing and…