office-of-tailored-access-operations Goto Github PK

fuzzdb

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

garud

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters.

gitminer

Tool for advanced mining for content on Github

golang

扫清go语言一切障碍，go语言实战、go语言从入门到精通,持续更新，欢迎star

gyoithon

GyoiThon is a growing penetration test tool using Machine Learning.

hosts_scan

这是一个用于IP和域名碰撞匹配访问的小工具，旨意用来匹配出渗透过程中需要绑定hosts才能访问的弱主机或内部系统。

howtohunt

Tutorials and Things to Do while Hunting Vulnerability.

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

ip_segment_collection

企业IP段信息搜集工具

iprotate_burp_extension

Extension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.

jaeles

The Swiss Army knife for automated Web Application Testing

jsencrypter

一个用于前端加密Fuzz的Burp Suite插件

jsinfo-scan

递归式寻找域名和api。

jsonp

jsonp is a Burp Extension which attempts to reveal JSONP functionality behind JSON endpoints. This could help reveal cross-site script inclusion vulnerabilities or aid in bypassing content security policies.

jsproxy

jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

linenum

Scripted Local Linux Enumeration & Privilege Escalation Checks

magic-checklist-for-web-applications

Web Security Checklist (Bug Bounty & Pentesting)

meg

Fetch many paths for many hosts - without killing the hosts

msfpc

MSFvenom Payload Creator (MSFPC)

ninja

Open source C2 server created for stealth red team operations

notes

documents

osmedeus

Fully automated offensive security tool for reconnaissance and vulnerability scanning

owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)

packer-fuzzer

Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

paradoxia

Advanced Attack toolkit, Native C++ RAT, Instagram Brute Force and Password Spraying over Tor, Mass Emailer, Malicious file Sentinel and more.

parameth

This tool can be used to brute discover GET and POST parameters

password_brute_dictionary

口令爆破字典，有键盘组合字典、拼音字典、字母与数字混合这三种类型

payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

penetest