bugbounty

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

This repository contain a lot of web and api vulnerability checklist , a lot of vulnerability ideas and tips from twitter

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching

Automated NoSQL database enumeration and web application exploitation tool.

Rockyou for web fuzzing

A collection of awesome one-liner scripts especially for bug bounty tips.

Scan for misconfigured S3 buckets across S3-compatible APIs!

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

Quickly discover exposed hosts on the internet using multiple search engines.

Gospider - Fast web spider written in Go

Web Fuzzing Box - Web 模糊测试字典与一些Payloads

Flutter Reverse Engineering Framework

🚀 Caido releases, wiki and roadmap

Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me

gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

The Swiss Army knife for automated Web Application Testing

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

Automatically brute force all services running on a target.

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

Tips and Tutorials for Bug Bounty and also Penetration Tests.

DNS Takeover tool written in Go

Hidden parameters discovery suite

A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.

🚫 Advanced tool for security researchers to bypass 403/40X restrictions through smart techniques and adaptive request manipulation. Fast. Precise. Effective.

For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙

A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.