A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Hunt down social media accounts by username across social networks

🕵️‍♂️ Collect a dossier on a person by username from thousands of sites

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

E-mails, subdomains and names Harvester - OSINT

Web path scanner

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

chat log tool, easily use your own chat data. 聊天记录工具，轻松使用自己的聊天数据

Tools and Techniques for Red Team / Penetration Testing

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

List of Awesome Red Teaming Resources

Cyber Security ALL-IN-ONE Platform

The all-in-one browser extension for offensive security professionals 🛠

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

Adversary simulation and Red teaming platform with AI

Red Teaming Tactics and Techniques

List of Awesome CobaltStrike Resources

Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。

一款基于各大企业信息API的工具，解决在遇到的各种针对国内企业信息收集难题。一键收集控股公司ICP备案、APP、小程序、微信公众号等信息聚合导出。支持MCP接入

面向网络安全从业者的知识文库🍃 (停止更新)

Snoop — инструмент разведки на основе открытых данных (OSINT world)

Automation for internal Windows Penetrationtest / AD-Security

💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

👻Stowaway -- Multi-hop Proxy Tool for pentesters