|
45 | 45 | - [Vulnerability Scanners](#Vulnerability-Scanners) |
46 | 46 | - [Forbidden Bypass](#Forbidden-Bypass) |
47 | 47 | - [Permutation](#Permutation) |
| 48 | + - [Web Proxy and Traffic Interception](#Web-Proxy-and-Traffic-Interception) |
48 | 49 | - [Useful](#Useful) |
49 | 50 | - [Uncategorized](#Uncategorized) |
50 | 51 |
|
|
121 | 122 | - [httpx](https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. |
122 | 123 | - [fingerprintx](https://github.com/praetorian-inc/fingerprintx) - fingerprintx is a standalone utility for service discovery on open ports that works well with other popular bug bounty command line tools. |
123 | 124 | - [graphw00f](https://github.com/dolevf/graphw00f) - graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint. |
| 125 | +- [wafw00f](https://github.com/EnableSecurity/wafw00f) - wafw00f allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website. |
124 | 126 |
|
125 | 127 | ### Content Discovery |
126 | 128 |
|
|
398 | 400 | - [Trufflehog-Chrome-Extension](https://github.com/trufflesecurity/Trufflehog-Chrome-Extension) - Trufflehog-Chrome-Extension |
399 | 401 | - [noseyparker](https://github.com/praetorian-inc/noseyparker) - Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history. |
400 | 402 | - [GitHound](https://github.com/tillson/git-hound) - Recon tool leveraging Code Search API. Scans for exposed API keys across all of GitHub, not just known repos and orgs. Support for GitHub dorks. |
401 | | - |
| 403 | +- [cariddi](https://github.com/edoardottt/cariddi) - Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more... |
402 | 404 |
|
403 | 405 |
|
404 | 406 | ### Git |
|
476 | 478 | ### Vulnerability Scanners |
477 | 479 |
|
478 | 480 | - [nuclei](https://github.com/projectdiscovery/nuclei) - Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use. |
| 481 | +- [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - Community curated list of templates for the nuclei engine to find security vulnerabilities. |
479 | 482 | - [Sn1per](https://github.com/1N3/Sn1per) - Automated pentest framework for offensive security experts |
480 | 483 | - [metasploit-framework](https://github.com/rapid7/metasploit-framework) - Metasploit Framework |
481 | 484 | - [nikto](https://github.com/sullo/nikto) - Nikto web server scanner |
|
508 | 511 | - [goaltdns](https://github.com/subfinder/goaltdns) - A permutation generation tool written in golang. |
509 | 512 | - [altdns](https://github.com/infosec-au/altdns) - Generates permutations, alterations and mutations of subdomains and then resolves them. |
510 | 513 |
|
| 514 | +### Web Proxy and Traffic Interception |
| 515 | + |
| 516 | +- [mitmproxy](https://github.com/mitmproxy/mitmproxy) - An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. |
| 517 | +- [proxify](https://github.com/projectdiscovery/proxify) - A versatile and portable proxy for capturing, manipulating, and replaying HTTP/HTTPS traffic on the go. |
| 518 | +- [FoxyProxy Browser Extension](https://github.com/foxyproxy/browser-extension) - FoxyProxy is an open-source, advanced proxy management tool that completely replaces Chrome's limited proxying capabilities. |
| 519 | +- [zaproxy](https://github.com/zaproxy/zaproxy) - ZAP is what is known as a “manipulator-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. |
| 520 | + |
511 | 521 | ### Useful |
512 | 522 |
|
513 | 523 | - [anew](https://github.com/tomnomnom/anew) - A tool for adding new lines to files, skipping duplicates |
514 | 524 | - [gf](https://github.com/tomnomnom/gf) - A wrapper around grep, to help you grep for things |
515 | 525 | - [uro](https://github.com/s0md3v/uro) - declutters url lists for crawling/pentesting |
516 | 526 | - [unfurl](https://github.com/tomnomnom/unfurl) - Pull out bits of URLs provided on stdin |
517 | 527 | - [qsreplace](https://github.com/tomnomnom/qsreplace) - Accept URLs on stdin, replace all query string values with a user-supplied value |
| 528 | +- [notify](https://github.com/projectdiscovery/notify) - Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms. |
518 | 529 |
|
519 | 530 | ### Uncategorized |
520 | 531 |
|
521 | 532 | - [RF Swift](https://github.com/PentHertz/RF-Swift) - A powerful multi-platform RF toolbox that deploys specialized radio tools in seconds on Linux, Windows, and macOS—supporting x86_64, ARM64 (Raspberry Pi, Apple Silicon), and RISC-V architectures without disrupting your primary OS. |
522 | 533 | - [JSONBee](https://github.com/zigoo0/JSONBee) - A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites. |
523 | 534 | - [CyberChef](https://github.com/gchq/CyberChef) - The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis |
524 | | -- []() - |
525 | 535 | - [bountyplz](https://github.com/fransr/bountyplz) - Automated security reporting from markdown templates (HackerOne and Bugcrowd are currently the platforms supported) |
526 | 536 | - [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) - A list of useful payloads and bypass for Web Application Security and Pentest/CTF |
527 | 537 | - [bounty-targets-data](https://github.com/arkadiyt/bounty-targets-data) - This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports |
|
531 | 541 | - [httpx](https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. |
532 | 542 | - [csprecon](https://github.com/edoardottt/csprecon) - Discover new target domains using Content Security Policy |
533 | 543 | - [SecLists](https://github.com/danielmiessler/SecLists) - It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. |
| 544 | +- [interactsh](https://github.com/projectdiscovery/interactsh) - Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions. |
| 545 | +- [asnmap](https://github.com/projectdiscovery/asnmap) - Go CLI and Library for quickly mapping organization network ranges using ASN information. |
| 546 | +- [mapcidr](https://github.com/projectdiscovery/mapcidr) - Utility program to perform multiple operations for a given subnet/CIDR ranges. |
| 547 | +- [tlsx](https://github.com/projectdiscovery/tlsx) - A fast and configurable TLS grabber focused on TLS based data collection and analysis. |
| 548 | +- [CSPBypass](https://github.com/renniepak/CSPBypass) - a tool designed to help bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains. |
| 549 | +- [BigBountyRecon](https://github.com/Viralmaniar/BigBountyRecon) - BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. |
| 550 | +- [Bypass bot detection](https://github.com/portswigger/bypass-bot-detection) - Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection. |
534 | 551 |
|
535 | 552 | --- |
536 | 553 |
|
|
0 commit comments