bruteforce the admin panel

Detailed information about API key / OAuth token (Description, Request, Response, Regex, Example)

HTTP parameter discovery suite.

Web cache poisoning vulnerability scanner.

A curated list wordlists for bruteforcing and fuzzing

BBT - Bug Bounty Tools (examples💡)

An advanced multithreaded admin panel finder written in python.

Find broken links, missing images, etc within your HTML.

timebased blind sqli with 99% success rate

Welcome to the 403 and 401 Bypass Techniques and Bug Bounty Tips repository! This repo is a collection of methods and strategies to bypass 403 and 401 HTTP response codes, along with various tips a…

Burp Extension for a passive scanning JS files for endpoint links.

40X/HTTP bypasser in Go. Features: Verb tampering, headers, #bugbountytips, User-Agents, extensions, default credentials...

A simple script just made for self use for bypassing 403

bypass-url-parser

Fuzz 401/403/404 pages for bypasses

CF-Hero is a reconnaissance tool that uses multiple data sources to discover the origin IP addresses of Cloudflare-protected web applications

Uncover the true IP address of websites safeguarded by Cloudflare & Others

CrimeFlare is a useful tool for bypassing websites protected by CloudFlare WAF, with this tool you can easily see the real IP of websites that have been protected by CloudFlare. The resulting infor…

collectvars collects JavaScript variables, highlights risky ones, and helps you understand code structure, while you casually browse.

Conference presentation slides

This Chromium extension scans the page for external iFrames, Scripts, and Styles, logs them to the console, and checks if their domains are resolvable.

deplist is a Python tool for domain enumeration, generating customizable wordlists and subdomains. It supports input files, subdomain permutations, and output saving, making it ideal for security …

Directory scans

List of Directory Traversal/LFI Payloads Scraped from the Internet