heades993 Goto Github PK

audit-learning

记录自己对《代码审计》的理解和总结，对危险函数的深入分析以及在p牛的博客和代码审计圈的收获

awesome-pentest

A collection of awesome penetration testing resources, tools and other shiny things

blasting_dictionary

爆破字典

bruteforce-database

Bruteforce database

bucket_finder

Amazon bucket brute force tool

bug-bounty-toolz

BBT - Bug Bounty Tools

bypass-403

A simple script just made for self use for bypassing 403

exphub

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

fastjson_rce_tool

fastjson命令执行自动化利用工具， remote code execute，JNDI服务利用工具 RMI/LDAP

gopher-redis-auth

This tool generates gopher link for exploiting SSRF and gaining RCE in redis with password.用于生成附带密码认证的gopher内容，用于SSRF等利用。

h5sc

HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors

hackeronedb

The unofficial HackerOne disclosure Timeline

hacking-with-golang

Golang安全资源合集

javasec

自己学习java安全的一些总结，主要是安全审计相关

jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

lazys3

legion

Automatic Enumeration Tool based in Open Source tools

nuclei-templates

Community curated list of templates for the nuclei engine to find a security vulnerability in application.

pacu

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

s3-buckets-finder

Find aws s3 buckets and extract datas.

s3-inspector

Tool to check AWS S3 bucket permissions

s3scanner

Scan for open AWS S3 buckets and dump the contents

sec-chart

安全思维导图集合

subtake

Automatic finder for subdomains vulnerable to takeover. Written in Go, based on @haccer's subjack.

tbhm

The Bug Hunters Methodology

venom

Venom - A Multi-hop Proxy for Penetration Testers

webalivescan

对目标域名进行快速的存活扫描、简单的指纹识别、目录扫描

xsschallengewiki

Welcome to the XSS Challenge Wiki!