XSStrike
s0md3v/xsstrikeAdvanced XSS detection suite with context-aware payload generation, multi-threaded crawling, WAF evasion, and DOM scanning for automated web security…
crawlerdynamic-code-analysisfuzzing+8
15.1k
s0md3v/xsstrikeAdvanced XSS detection suite with context-aware payload generation, multi-threaded crawling, WAF evasion, and DOM scanning for automated web security…
subzer0x0/react2shellIntentionally vulnerable Next.js lab for CVE-2025-55182 exploitation research. Docker-packaged environment for practicing web application security…
tasooshi/horrors-log4shellMicro lab for CVE-2021-44228 (Log4Shell) with automated multi-target exploitation, runtime payload generation, and adjustable bypasses for security…
akto-api-security/aktoOpen-source API security platform for continuous API discovery, vulnerability testing, and runtime threat detection. Integrates with CI/CD pipelines…
wpscanteam/wpscanWordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…
urbanadventurer/whatwebWeb technology identification scanner with 1800+ plugins for detecting CMS, servers, JS libraries, and embedded devices. Supports stealthy to…
sullo/niktoPerl-based web server scanner that performs comprehensive vulnerability checks, CGI scanning, and server fingerprinting with customizable plugins and…
enablesecurity/wafw00fAutomated Web Application Firewall fingerprinting tool that identifies and detects over 200 WAF products by analyzing HTTP responses to normal and…
oscerd/cve-2026-49042Reproducer for CVE-2026-49042: demonstrates prompt injection in Apache Camel's langchain4j-tools leading to RCE via unfiltered Exchange headers.…
rajanagori/nightingaleMulti-architecture Docker toolkit for penetration testing with preconfigured tools for web, network, mobile, API, OSINT, and forensics. Features…
therealaleph/masterhttprelayvpn-rustFree DPI bypass tool using a Google Apps Script relay with TLS SNI concealment. Provides HTTP and SOCKS5 proxy, cross-platform desktop UI, and no…
opsxcq/exploit-cve-2014-6271Docker-based Shellshock (CVE-2014-6271) exploit environment with ready-to-use attack scripts for CGI, SSH, and DHCP vectors. Includes vulnerable Bash…
blasty/cve-2021-41773Docker-based playground for testing CVE-2021-41773, demonstrating local file disclosure and remote code execution in Apache HTTPd 2.4.49.
karthikuj/cve-2022-42889-text4shell-dockerDockerized proof-of-concept for CVE-2022-42889 (Text4Shell) with script, DNS, and URL lookup-based RCE payloads for security testing and education.
blueteamsteve/cve-2021-41773Provides vulnerable Docker images for CVE-2021-41773 (Apache path traversal) with PoCs for file read and RCE, enabling security testing and practice.
sixpacksecurity/cve-2021-40438Proof-of-concept exploit for CVE-2021-40438 (Apache mod_proxy SSRF) with Docker-based vulnerable environment for testing and validation.
bhdresh/cve-2018-11776Dockerized vulnerable environment for CVE-2018-11776 with proof-of-concept exploits, enabling hands-on testing of Apache Struts2 remote code…
thegebirge/cve-2025-32375PoC exploit for CVE-2025-32375 targeting BentoML 1.4.7, with a Docker-based vulnerable environment for testing and verification of the remote code…