Arsenal is just a quick inventory and launcher for hacking programs

A tool to perform DNS reconnaissance on target networks. Among the DNS information got from include subdomains, mx records, web application firewall detection and more fingerprinting and lookups

A community sourced list of log4j-affected software

A list of search engines useful during Penetration testing, vulnerability assessments, bug bounty and more

code-searching tool and static code analysis - Beta

Active Directory & Red-Team Cheat-Sheet in constant expansion.

XSScope is one of the most powerful and advanced GUI Framework for Modern Browser exploitation via XSS.

httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.

Rockyou for web fuzzing

A tool for automatically generating markdown documentation for helm charts

Fast web fuzzer written in Go

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

A python script that finds endpoints in JavaScript files

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

🚀 Pre-flight checks for ECS Exec

a list of awesome Grafana tools & resources, both official and community-built

Fast and customizable vulnerability scanner based on simple YAML based DSL.

Cloudlist is a tool for listing Assets from multiple Cloud Providers.

NERVE Continuous Vulnerability Scanner

Rust-based high performance domain permutation generator.

Identify privilege escalation paths within and across different clouds

Symbolic execution tool

Ethereum smart contract fuzzer

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

A guide to smart contract security best practices

brownie port of damn vulnerable defi

Static Analyzer for Solidity